0cfb7b26cbccf3b809aeee7e8c06f2b4e13b2b9419b80f96e3c20614482748a8

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

63dc4be22be53d10c77bc5b83743c190N.exe
Size

85KB
MD5

63dc4be22be53d10c77bc5b83743c190
SHA1

d3ea8e56c293c1ceb21533174949a2ed23ee8350
SHA256

0cfb7b26cbccf3b809aeee7e8c06f2b4e13b2b9419b80f96e3c20614482748a8
SHA512

16fc678f5da83462afc48b63d382c2a41c20ba448af8b1b1d3a2573721dbbda5c99145789026feba00c1b667ac7293c753931d73a144c8740acb1c78093d46bc
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgL8:fnyiQSoFcQ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4542) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4764-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a0000000233c2-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/4764-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	63dc4be22be53d10c77bc5b83743c190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	63dc4be22be53d10c77bc5b83743c190N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63dc4be22be53d10c77bc5b83743c190N.exe

C:\Users\Admin\AppData\Local\Temp\63dc4be22be53d10c77bc5b83743c190N.exe
"C:\Users\Admin\AppData\Local\Temp\63dc4be22be53d10c77bc5b83743c190N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
86KB

MD5
01285e757ef7d095207dbcc229de0611

SHA1
7ef45dcb92ed8b6c3314ba5d7019adb397020b08

SHA256
c9951098858b0a62c9165cbcfc63b3dd87eae73898795b4ef1e8043988d9795b

SHA512
9c9bf05fdb3acce319299ff4ca7efb993c5652490a7122c97d7b6bca3d7f4f459b2ff66ea4d76c61f2087d7b979684b4115682db3795d0a896c94b8ff44630ff

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
071c90ac4a23cd240f36baea5844b643

SHA1
6ede14f1792d1a7ae84ae4f7e7cb61d5cb005581

SHA256
932621e716b924ed61b310f06136ec46ff7a64252cbe811ae503c8507bedc207

SHA512
ee42c8e11273788db0ba011bb3a47b3099007ede25a809f9e43abea352ccc202f941a77c233fae1e16db50dee4c3a66a6674e965142da11b375f1fec3271f849

Download Submit
memory/4764-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4764-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download