bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
Size

62KB
MD5

6aea76205d140b71fed6cb7b041eb8ab
SHA1

22d59a90cfdbb53b3496b71593dc290154ca3f67
SHA256

bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de
SHA512

021c54191fde31505b0902ae3ce1bece07d4332887ecb9c33f1452b2c7008ac187938749322beaa71a64da964b05fb8100849b5b7f5415b2eb889c5d4600efa0
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti2Q8Qw:V7Zf/FAxTWoJJ7TTQoQ1fw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2896-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023424-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/2896-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe

C:\Users\Admin\AppData\Local\Temp\bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe
"C:\Users\Admin\AppData\Local\Temp\bc1b112f9079336c7356beb89ea86eb5a060ec0ad47fdb8b2e098fedcb5529de.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
62KB

MD5
b92fc16fc96552c6c7df664bbce68971

SHA1
c1b52f94780d90a1f8a33443de07f3369d630c06

SHA256
4588051667098966c246b165455e1bb6807d0f7683f83f8d9351eaa51dc8163a

SHA512
c083df9481b1487f367bf3d05c96e155c9f05d0bf093fca3d40dde1c63eae14daec3a1717c5d5a7e2555068684d0db95c5bbdcdb4e958f39b3fcf6cd89b5a1ca

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
fa3dcc4e61a7da6f808e64ae8cf27f7d

SHA1
9372a93b882398e54f78ffe14bd06b8de0377dad

SHA256
cf19d3cd953859d7fb295f1af417ef0a3fe8a489fa388f49281c7d6c30e99ea2

SHA512
7f75bb1e6e89d01de6d604f3d4d77b31b2719d4a67268b1f3df2e9e0d34b12bf32f5c3891ad83730123643bc5b8c295ce8a5b1d8f8b3eb8a4bdd2f3845b6754e

Download Submit
memory/2896-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download