2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
Size

117KB
MD5

fcdd76b0d6a7c84899a4de00eb8167d7
SHA1

e757746f710200bdef3293654fe344d00b5718f7
SHA256

2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2
SHA512

b143b6d6ee4aaa9c04349f441f733b55bfc989c71db6db533631b3ba22b46f7819f86f1c12522f78bfa899f6275c8a619ddc233de4a42a30ef6f9c14410d47be
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZf2XcqvcYaB:fnyiQSo7Zf2X0B

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4856) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3520-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023456-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/3520-796-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe

C:\Users\Admin\AppData\Local\Temp\2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe
"C:\Users\Admin\AppData\Local\Temp\2c3bbd1809ec94851bceb33fa971f23f16d548f76e4691a763ed4e624eb91de2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
117KB

MD5
4e49c1fcc15846c54290aab084d018d0

SHA1
8a0402da816c8985a06810fa738fadf7c4dd7e87

SHA256
e50d4ef65eba3293f95ce10db8f410da9d46d68a561e45b0007515edd79a5f4e

SHA512
ba6c210d01dd1be13f42cafda6977a9e5a9f024ba46de8042637b3251455213a94030d062552ef0a6ee793a0ceb977ae2d3ebf9ff7074007ae6e8af341a6e790

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
216KB

MD5
9209f3068299ed326ff91137331455c9

SHA1
38f3896b925911d928eb3a72fb8233b8ee328959

SHA256
fe310c88c029fbce71a655c39de05fcddd21fec05bba7179bd8296a0ea1c4f10

SHA512
b1072f10ec1ea7eeee14872580c001eae9ce61522a379300e8320cfbe8a6bc3d84559cb616d4ba2778bdbe69568c4d6b38ce2d7e96065a7155a930631dac2a6f

Download Submit
memory/3520-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3520-796-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download