01b7807b874f4ef01469e75ceb40b9464c3361c04ea026d304f04ab72617d347

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c10d0c2bec9deaef4efcfc62f4d55620N.exe
Size

53KB
MD5

c10d0c2bec9deaef4efcfc62f4d55620
SHA1

76b3eeba6839cdb918c98fafb8482fa6d15811c2
SHA256

01b7807b874f4ef01469e75ceb40b9464c3361c04ea026d304f04ab72617d347
SHA512

97dbf06d99fbcd78003143b5194f384862f3aeac214c7ac1fcf8fb9e094f6bc23a6597d889f69048dc7c285d9331613b8734b3f09d5560851a995aaa55e2e36a
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIg:CTWn1++PJHJXA/OsIZfzc3/Q8IZTK

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2412-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e5-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/2412-1158-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	c10d0c2bec9deaef4efcfc62f4d55620N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c10d0c2bec9deaef4efcfc62f4d55620N.exe

C:\Users\Admin\AppData\Local\Temp\c10d0c2bec9deaef4efcfc62f4d55620N.exe
"C:\Users\Admin\AppData\Local\Temp\c10d0c2bec9deaef4efcfc62f4d55620N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
53KB

MD5
8a2c300b177b13ba03479f71b311faa3

SHA1
385fd3b2e6edfcc58bf8b14a6acfef1f57e73da9

SHA256
a3153c8a9ff78598a1a57b83da290cf6d7e825a60bb89e9b8428010684b81793

SHA512
16aea5db590abdff16c7559ded380141bda5a21060ccce5e97216d0c645d9d827e742bd2f9e0e20e1ede3070d658c531b4d686d6ef4ff4183ef27c888c1fe0e5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
37495dddb09a27b7e30347450fb6fedc

SHA1
85d9a77c8f494723cb2370a1799aaa3a41da8770

SHA256
4852ebf674a1eb5cece0415792440b682ce818e57efe69fdad1975ea7f9a5919

SHA512
66a1eff7058d3abf5a597f5ebfe736f11bd39aa11a76be10d1ee3f5bf96e4b365685542d18b1e89fcd389bd562bfcef9381440d6d50b164bf02a642a7143eef8

Download Submit
memory/2412-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2412-1158-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download