23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
Size

38KB
MD5

72bd8f715a5cf2dc3c4acf18e22bec34
SHA1

6416ad90e46cbb42773b7af4ebe912acf8bb43ba
SHA256

23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c
SHA512

01e6fad50a0c3c237028a2f2f9c1c68200d12d68947cc7c4cc6b26bd116241f3f6bb1e805bd5b8a9b56a0706ba18b5aed4cde414cab1c4ed970ac11feab0915d
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tix:CTW7JJ7TTQoQx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5230) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1468-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233d6-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/1468-976-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe

C:\Users\Admin\AppData\Local\Temp\23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe
"C:\Users\Admin\AppData\Local\Temp\23ea2f863b00cf7fc772c916cc895a4c59d3dd65a0d52d09c0ddb9bc4bf9151c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
39KB

MD5
4adf970c0d844ad4a4146d25c74e1b69

SHA1
a07221cf314914b2de3d341038b82f160aa94946

SHA256
1ec841363bcddcbd56dc23148f63fc255691ac6a150a370b7e1d8a584fa4e481

SHA512
d727dd7584ec8e942084b826df0faf637f33fb8f351e1f4154bb0168249a5bf6d375e163e0668a69aeea84be8c9de7c2990b3aca4fa58bda151ddec41ee33dc8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
69cb827b6f873f47d969bf2a8def5f5b

SHA1
6951af24677126b6ab185ce7d7d3701420e52b43

SHA256
1a37e188ea04011a92661ea7260fec6bb4009e127b574f560e8ae32f93df2dd7

SHA512
4c30fb4adef38e86ab8d2ed613c339d4c4ee598e7d6227d941a3f3d88d1eb6e519f15dc3dbd01f4772466b54f5c31a128ed4b2a218d2ec463740e5ab3ddb25be

Download Submit
memory/1468-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1468-976-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download