28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
Size

44KB
MD5

9a217f201ce66ed611daa753ac77390b
SHA1

f23782e6d384a5e79af7894501d5d9fb68339984
SHA256

28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6
SHA512

693334a7a201d12bd8b8e7eb4c71aa6ae40a908b8d6e0e542a91a8e52fa1464ffc1db6c6ffde5ab1b71bfc369424f787947366aecd5813cf05103ce9037a2174
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiwc+mUI+mU3w8:CTW7JJ7TTQoQhUiU3w8

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00080000000233b9-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2072-867-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe

C:\Users\Admin\AppData\Local\Temp\28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe
"C:\Users\Admin\AppData\Local\Temp\28ce54559160660b0a617d6e696964021f1bfdef3d9a60cdd3555e1ee1c28eb6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
45KB

MD5
3ae446cca4c07c5dd0618d5db07ca355

SHA1
9380085de5112275c6068f68cf548bb7e9ef02e1

SHA256
d97aa4fec5b93b3b6e294bae2a270cdff2265fb2dbd4869d1c2628fbc0925b07

SHA512
5ca0f11d11869763dd959fc067385a1d0742fdb0cb33f7c8bbcf24bb6306df3f3049ab599e74282e5d80d69d09018c84d2b82ad449a737a8627f82eed6b1fcbc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
16d98c9f64fe0f32945305df614333b7

SHA1
4107491abff466d833124f4b1d72be2b1de3700e

SHA256
18735f71b70eda3e204aa31515ce0d2c7ce53433989d021b58cca5bd4a0524d0

SHA512
e3816dcbcbde48095af922dac24748df140e893e59fed369eeced17f46fea2c9231636ea9ea0f1e6b7581e4ccb1951ee1784b7d5d61bb0afb0a41ae982a0cc9e

Download Submit
memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2072-867-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download