c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
Size

59KB
MD5

fc7a5d374e7a08dd9e38f8270b5ad8c5
SHA1

eff92d4891deca34b15f66d33297fc19cbbe1b53
SHA256

c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5
SHA512

75bb81aa8f1f213c64032596956620cf102492aba3b66566968227e98d685f261808a30cf3204f33c857b44b6f465bdd2c63f2e9b2e019444c0366fbf08e7fcb
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfIf:V7Zf/FAxTWoJJZENTBHfk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2988-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233d6-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/2988-1970-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\DocumentRepository.ico.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe

C:\Users\Admin\AppData\Local\Temp\c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe
"C:\Users\Admin\AppData\Local\Temp\c78f1353af01a91c53f30325c7a27de3a6f3519bf5d6a789f83caaa4bc72efc5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
59KB

MD5
e4078fa65ab7cdbccdedf6a32acd0534

SHA1
01125d805ae5f5de1f0a7fd38d739f3a8b7c6611

SHA256
de81df485a7e92bdc8e3a6d38c5d57f196e42506d37d91793bf28ba9b4f9be90

SHA512
941e23daa441e8b80acc5cf16d475446dd648cd8ce64d3ab38aef2c0b5edc53bcbee1a29adba451384cb2f106bc50f7f2838fcbe7ec6ae1c9e2c1fedb5bb2b3d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
52c82c4e0be3da46d924051704522b9f

SHA1
a254e7d4cee5bfa244b1ffc14456d79c7c6534e6

SHA256
d3caad2ede282b3a6efe2f94515c92abcc47aeb51d84cfbfe97c66f6c69560df

SHA512
7bee8c961fc71757161458283dcb159800977c0c574952977821269826bf297e8b78604eca0904c37df143087bbbbe5e7d3bfda9c1ba8f23e626fd56a01fa1b7

Download Submit
memory/2988-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2988-1970-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download