19ef55b466a7b608808a4ba5b16261ace4400cc8aac235253b4e030a03f98662

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c0acc207262e1c235d1e6d5f4fbf560N.exe
Size

46KB
MD5

2c0acc207262e1c235d1e6d5f4fbf560
SHA1

ac84f11272aea545e065f0e106d384190674c182
SHA256

19ef55b466a7b608808a4ba5b16261ace4400cc8aac235253b4e030a03f98662
SHA512

df8466e7b81abfee967f362e697716600c26c4cfe80c324a1717a05b10b7129da5bfd09f39edf74dc9b93e485fa21ef075a9647e1098431448b7c9d93835fd9b
SSDEEP

768:kBT37CPKKdJJTU3U2lRtJfOKI+D9Ii1xsI+D9Ii1xNHRpTjrgMpi1xsTjrgMpi1I:CTW7JJTU3UytJfOKI+h/YI+h/BbTjru6

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00030000000178b0-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/2264-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\EnterWait.wax.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\BlockConfirm.nfo.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	2c0acc207262e1c235d1e6d5f4fbf560N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c0acc207262e1c235d1e6d5f4fbf560N.exe

C:\Users\Admin\AppData\Local\Temp\2c0acc207262e1c235d1e6d5f4fbf560N.exe
"C:\Users\Admin\AppData\Local\Temp\2c0acc207262e1c235d1e6d5f4fbf560N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
46KB

MD5
7ce6a1d3fc9f818dfd513451d68536ce

SHA1
ad0e458b83542fbc7ace2bb7331dbac147211343

SHA256
1ef6ab3b7bd682fd8d5941d5fba7ed5a0a3c47074a59d85c7e5d90352ba1341d

SHA512
1ab0481328c9ec4d9d0392f7acf3ae7071325200d7a8e1d67131864a197fa46e981f344c17ee32df52bf6b4cc471fe4cc3a6a20041d908060edaa7513b25438b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
2e38b740768446f941dbf802e6abe17d

SHA1
183b7f6a55e052d5afeaf3aeded2834395ab4788

SHA256
0b127b7e25b5f0876988c6414bf25fbe61f3f4ac0923847a51e385ca7bab8d54

SHA512
f44cffa582b8fd09f2c32d3dc7319635b76b10ee6ca7daa8cec689790a91f13fb23ea4944bf1c0c783a9bcbb532fa9289ef882e466b1ff0d84287a8fbe6cc9f8

Download Submit
memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2264-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download