cbec52db28b7fc46b046bef4e6e94488d7889c297639432517c976408cff940b

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80276ca772d47c3e792f06b1b79541f0N.exe
Size

57KB
MD5

80276ca772d47c3e792f06b1b79541f0
SHA1

afcebb86a302361d82e39616bf8da0c9542535a8
SHA256

cbec52db28b7fc46b046bef4e6e94488d7889c297639432517c976408cff940b
SHA512

bcfa925b246e3c48672a04d45ce346cca11aa91f9f243031ae2f2eeaa20b9b618ef768be02af087fb986803d0dbb48e17cea0129bbd8f491c53b2a558e24cccb
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mdC:V7Zf/FAxTWoJJZENTNyl2Sm0mGnL

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023457-2.dat	upx
behavioral2/files/0x00080000000234ba-6.dat	upx
behavioral2/memory/4072-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	80276ca772d47c3e792f06b1b79541f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	80276ca772d47c3e792f06b1b79541f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80276ca772d47c3e792f06b1b79541f0N.exe

C:\Users\Admin\AppData\Local\Temp\80276ca772d47c3e792f06b1b79541f0N.exe
"C:\Users\Admin\AppData\Local\Temp\80276ca772d47c3e792f06b1b79541f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
58KB

MD5
729d1b286df547e6e3804d39ba687b77

SHA1
82da50eea47ab9c803b7a0cb5add88f1b7b7dd33

SHA256
e5d0a8b85ab959fa1a6416ab56387daee6c63d1f7baed70f42656b753c0fc4a4

SHA512
a356a25bc1ff6a83227682b96b711599d83a8bee7a02c49372f5875f6c4cfd5fa94502f6c5fceaa9cd2015fe3ff789036f8e8550d2126f880ace6d6c69393158

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
9ee4ec2a00c064c144b2b66e584c6a57

SHA1
9b35b7bb6eb4e12205abe591959a0d0c5f5ee7e5

SHA256
aa55051d0ccceff92db2a40bfa3ee685918a16fe401ea96d24d776e8754f00fd

SHA512
9b2aaa0923996dc30697ae191f33a0ade8d592eda166be6316d92463c1c4e9e40e11de892862b485afc3a85480d166c60a9819c52ed632327868b8c59e9e0118

Download Submit
memory/4072-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4072-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download