cb359f126085e6f05700192250d1d8dce65877a7f95fc1cf402fdd59f9d04ce5

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc65acb62595241f3024198d3486d960N.exe
Size

70KB
MD5

bc65acb62595241f3024198d3486d960
SHA1

6ab397873adc55744092c1c4bc013ca83070456a
SHA256

cb359f126085e6f05700192250d1d8dce65877a7f95fc1cf402fdd59f9d04ce5
SHA512

2afd51359d7830660d52e54a6feac0b8ae827449e2bd8badf735ac638639a4212904c3b5a89c511249388008449fe5e7e5a3df8a6bbdc9638b79c421457033c8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2re:V7Zf/FAxTWtnMdyGdyoIOI1Qq2

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4008-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023598-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/4008-852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	bc65acb62595241f3024198d3486d960N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	bc65acb62595241f3024198d3486d960N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc65acb62595241f3024198d3486d960N.exe

C:\Users\Admin\AppData\Local\Temp\bc65acb62595241f3024198d3486d960N.exe
"C:\Users\Admin\AppData\Local\Temp\bc65acb62595241f3024198d3486d960N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:8
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
70KB

MD5
ea0e4d37f1cbdd489baf0c8cfd85d7cc

SHA1
a280d6d7e173d68926323b5972b0ab42f0bb7abe

SHA256
b18dc72b5ca09a09d055bbc22f77c0bf8c0c2de5de2af65aec6599df4830c869

SHA512
ec5bc5afdfbc31da81b11cc7915baa3d07a40cbf71a806323ac688b9fbdbfa7f27e5a17a57eafdf728df7973a19bf167d804095658c65bfa743ada7e31ac4d7d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
182KB

MD5
f51eac5e3cd6f636314317db910e24af

SHA1
8918d3fd1ed52affd8096e136b87278ed9b544d4

SHA256
635aecf8c3ea456f089e1b025c570bdfbe852725876d6918dc3c7ee662732dac

SHA512
ff2ec011e02148b9c54558ceb22d75bc73ea147b1e9dc33fcb3b7eb085a88465dae57f193695df41e7a1c135458621974770d85a8574d8a19dcc1aae3c335b55

Download Submit
memory/4008-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4008-852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download