4ecc0c75abced3423b1eb397caaddd52d4072deb06fe656f8e1f171c19165bef

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc3434c81feafe3b697ca5997fd9e790N.exe
Size

48KB
MD5

bc3434c81feafe3b697ca5997fd9e790
SHA1

ec7f153abe30e37d3276cbf2eda519a27da9bd4a
SHA256

4ecc0c75abced3423b1eb397caaddd52d4072deb06fe656f8e1f171c19165bef
SHA512

3de68bac7fc8cf4f36052b0f018cd3fd7b6156c68549fec9a11a5259a047a3690c577165d8ac0ae93be3af0bc13a0aa0ccb161eb8242d90c8059bdc74912459b
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdu:CTWUnMdyGdy4AnAP4W65

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002345e-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/4928-1007-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	bc3434c81feafe3b697ca5997fd9e790N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc3434c81feafe3b697ca5997fd9e790N.exe

C:\Users\Admin\AppData\Local\Temp\bc3434c81feafe3b697ca5997fd9e790N.exe
"C:\Users\Admin\AppData\Local\Temp\bc3434c81feafe3b697ca5997fd9e790N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
48KB

MD5
4d73207c66cd9e3a7b9de264e20fab7a

SHA1
f3ba5f8c2c5038f6e983cac81c57f002167410f4

SHA256
1dacf2be2405fed3cbc8540b721a9974169b6157fd98e48d94ece451ccc9cf9c

SHA512
7084a8435c5c8190df31391ff29f6bc4ec82c22b581de8fe2f5b47b9de6bb909fe27fd8917adff3900e7478c822c71567cebeefdf37cd37a69bdd4cd7baf373d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
708f88025e31d3c1d348adff103da13c

SHA1
418bec45135b9bfa51cacf94303d799255b761ae

SHA256
558f7c529673f4ac76f021a6056aca10bf3a6e9a01071ff4789ca3e2496c267b

SHA512
91c1c283611e5f1d7def56922abab9ef96243a59988b834bc648b2528a59c060eae6914e4cb47c4fcd3b9cd63ef359b48bbe7c4a6b5b2a2648ef78dd15807913

Download Submit
memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4928-1007-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download