9a563bf92a6559c8d19e35187861f384675fb2ccf61566d6e4516320c0c6e3c2

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
Size

54KB
MD5

cf9fbc5cca6f4c97b0a6952c9cdff920
SHA1

9e6318a1ab4207af74a9adc10c267bc182dc9ab6
SHA256

9a563bf92a6559c8d19e35187861f384675fb2ccf61566d6e4516320c0c6e3c2
SHA512

09d6c383be1bd5e02cbb1a0cb833292b548b6ab579b60bcc85807c64a0a86543e7466fb3299b7d7c6d0ba10a86979da817b98b72e29bb25b758c3db554c7b543
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJTU3U2lRtJfOV:a7ZyqaFAxTWbJJTU3UytJfOV

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1168-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023455-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/1168-852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf9fbc5cca6f4c97b0a6952c9cdff920N.exe

C:\Users\Admin\AppData\Local\Temp\cf9fbc5cca6f4c97b0a6952c9cdff920N.exe
"C:\Users\Admin\AppData\Local\Temp\cf9fbc5cca6f4c97b0a6952c9cdff920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
55KB

MD5
07f473e084748e3a78c1cda8dc3322ad

SHA1
09a2448f6f10e1c44df54e8de10e44de6b320b86

SHA256
be01bc32f5e1317a6a010c2daecc4066ab35a986c3133f99ae6c3e7d9c3cb703

SHA512
1b15972d42abc416a19e6c8d8d57ff071ed060b354ced82edc9ad75763f1714ebafd61f9ee50257c13518a3b27d4484966192bf2aed0bc0d98d7c1449a778da2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
1e6aa9ac520daf2c10cbcc1880eda1b7

SHA1
0c8ceb1b3b539adbba1b31c303a954bebe5d5d07

SHA256
9dbceb0899c55724545c299dc7036f4fd57dfeb01c86561118c213de6b635628

SHA512
a64111a20d32e8a3ed24e5d31e1074ee09cf39193e0d9de04ebe798487451bc4971f438aeb5a7375ca1d98f12c0a507133009c2f70757ba48bdda3d5a76553d3

Download Submit
memory/1168-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1168-852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download