f4d1b8409b026087cb0895711c91277c75bbaa4ac3c13056b615a74e9eb8253b

Analysis

max time kernel
119s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c66242afbf3ca7627e56da5720fc4ef0N.exe
Size

86KB
MD5

c66242afbf3ca7627e56da5720fc4ef0
SHA1

f6ae2a95e36b7ff9b33ea1b3fee5ead8068b19e8
SHA256

f4d1b8409b026087cb0895711c91277c75bbaa4ac3c13056b615a74e9eb8253b
SHA512

3147864348f4496c303e83210553e7e50c9440f337cb27a1b260e0855c56b0921d3f1125381021dfab20c60ba3b51ddcfc33e20bd0b9bff89b79a7f56a5a19b4
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5eYAWPkH:fnyiQSox5W

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1592-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002347f-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/1592-876-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\CheckpointRepair.ini.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	c66242afbf3ca7627e56da5720fc4ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c66242afbf3ca7627e56da5720fc4ef0N.exe

C:\Users\Admin\AppData\Local\Temp\c66242afbf3ca7627e56da5720fc4ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\c66242afbf3ca7627e56da5720fc4ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
87KB

MD5
7fa7a385c631c5b477245da987b97865

SHA1
780bf8b69430961bb530b1bb87a3e19f989e8bf0

SHA256
91b848808fef3b57b2b9f97ce87404e5df9d0bbaa74b356aabe2f29f560dcc80

SHA512
be58d790a2778c5d2583f4103667987267e7d20e1caf8a78e7fbe467408bd1d5be3b6398122d2227c792484edb5d7c110c5471af50092e872772a3abf427848e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
185KB

MD5
f63879f7ab6517b71fe696d09fd02105

SHA1
1ea253394eb15159f3e01aa198950ca99469d874

SHA256
99cf52e213aeeeecbf18a8017b694c9a73dba875fe6ac34984d6a8a2e6a55e61

SHA512
d5da826b68354b64bbce381dec3d33455c783cb0bbdbc6fd183a0bab5a396ac2a3eddcd54fef33ac0bf599d55f1fca6390528f00578fe302d18826ec6cd24bc7

Download Submit
memory/1592-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1592-876-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download