a64e7723a28f0adef872926c0c95bb08cadd559981571502371b3f1a6b0b6f8c

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ccb834eb855b7c25788e9f91d9ac65f0N.exe
Size

30KB
MD5

ccb834eb855b7c25788e9f91d9ac65f0
SHA1

80f0f1f50622e7d3ebe301c4c91416ae392aff56
SHA256

a64e7723a28f0adef872926c0c95bb08cadd559981571502371b3f1a6b0b6f8c
SHA512

1aa18fffdfc42eb20b47b6852fa3b0b8bde0ce49e1a1667244b10e9c2ae0cdcacfc50c945d320b1cfdfafa410d416ca575a9ff162dcd6ffd6d144e8aa1b78232
SSDEEP

768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OSBG9GB:CTW7JJB7LD2I2IbS5

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000234a8-2.dat	upx
behavioral2/files/0x000a0000000234f4-6.dat	upx
behavioral2/memory/2984-1017-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	ccb834eb855b7c25788e9f91d9ac65f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccb834eb855b7c25788e9f91d9ac65f0N.exe

C:\Users\Admin\AppData\Local\Temp\ccb834eb855b7c25788e9f91d9ac65f0N.exe
"C:\Users\Admin\AppData\Local\Temp\ccb834eb855b7c25788e9f91d9ac65f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
31KB

MD5
42de8eefb14727944c43804b08bafe90

SHA1
0b4f5844f54c6c2db55d9ea8e3cd82d5740af80f

SHA256
ffa740e4eb5f6527a743681239115456385d4788179f25e4f38b9670d1369f39

SHA512
d7848e78da7359f422cd61f8bf0ef1766f25211c0f720c8e46cd595dfb4523f2bc16e8a10fcd6c0f8003251777d4a7d4045e66e3c599305923d5c05edb0e3878

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
129KB

MD5
c3bfb60311da63752c5405bfc3835c24

SHA1
ea97a1485c0294487c0018928e25018afa2db59d

SHA256
5ab899993edf21a3a30bb843c6efc5e611cf35a7016f41c6a0e735ba57c5df80

SHA512
6c5a4e83e75ec8529b5459141613b7f89aa4365cd2046b1a075e43156ea56e6179ed9749643c83309d05b2e4ec128effb7d0ded56b0d1173eea3532f3aeb71de

Download Submit
memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2984-1017-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download