c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e

Analysis

max time kernel
149s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
Size

56KB
MD5

f3214278b86718b1f9660fd5c8b622b3
SHA1

cbca72a934ba6c84d577722d315478fc8fe21923
SHA256

c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e
SHA512

62fc1017f8b33f899c75529f3c12399b526c0d2567a32159de0d3060f976a8a58ad99ba47676b7e42fbc5e655b9f41778772327e6cda785bfa9929eceb36d41a
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZTzJ7XJ7I:KQSo7ZQ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2500-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023466-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/2500-1144-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\desktop.ini.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF.tmp	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe

C:\Users\Admin\AppData\Local\Temp\c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe
"C:\Users\Admin\AppData\Local\Temp\c417284cb871e0769ade0ae97ee0bd80c371a7b248c05d419dba56830641236e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
56KB

MD5
0183e5fc859918cb1b66fe9e3efb4c36

SHA1
c7634db8a4797bb6c1fe614268ae1a231c65163e

SHA256
3365d45ca54a4eb0ccb0bd3fe940de790c5ccb0a121bc9d57117df23493dd6b2

SHA512
2abf1be53c45412edfd57e5bbeb0ae3b8d5285f4ef4dfe8a8b664c7671cf57bec121101df3637b4a676394defc26839e4c880e866bf7eda6e79aae4feb61687e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
606f8fef3c8637badfe3aacd91154aaf

SHA1
036c657b0b6349d82187cb28d34ca67a5483fbb6

SHA256
57600eb001419b228dfa43ec4045c1390c900065693df28f0e824d5987754a9e

SHA512
40b4afed1c32907c8a2ed45d0163495ae297ae8ac4e694a2d634b2763fe1e734de99af3e9693d91f0a378837e7afae35c42d5d7c0bd0d958adcff83fe260839b

Download Submit
memory/2500-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2500-1144-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download