1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
Size

25KB
MD5

99e6bb5f56fbe0a15a53db813c71ab99
SHA1

21f506816cf8623ecdf97d3b97bf7bcb9f5514a6
SHA256

1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436
SHA512

ccd759d0d9022e19a76a0be2bd9fafb5c46c0c9e22f884b7f55e01013d20b3791e64d87075ba368b4f43d82d754789db82dd49eda2b18dbcd91ae2b0772dfa91
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9Zmuk:kBT37CPKKdJJ1EXBwzEXBwdcMcI9nk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3796-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023486-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/3796-1035-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHIC.TTF.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-convert-l1-1-0.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l2-1-0.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe

C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
"C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
26KB

MD5
7892e033ee02bfdd1fe8e3681bb36d5f

SHA1
ce5d0db19524294b1385799e3b0d0fe7f0fc3f0a

SHA256
773ec6f330d483318537af5011dbdaf6b8cf81af1bf4034422cf99bbb833659d

SHA512
dc74ed5099855438fa8eea588edfba877ed494c6663235b51de74f3a1fd20d6f8bdb938991da0567a982973544e87a2c9e565f0e68d36cf1430856ed991a3812

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
124KB

MD5
232006202aaf9b01e70279114689e487

SHA1
72ac6006913aee5f168375e696778dd9fe34b27f

SHA256
24d0e63e151bb3ba16daae8aa7d89c727529df6c1bf3ee1fbce943fa641a606d

SHA512
d3ba61a823d1ce220d13cc10d514f2e38c7fd655b724792c8c7441dde275a9cb0496d9cac2743adb64c945d767dd1628c39db3676a61b8ef62d0b63781281a45

Download Submit
memory/3796-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3796-1035-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download