7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
Size

68KB
MD5

249b829e2d0b68ccca8d0c9f868c69ea
SHA1

426de58e5893d501ada5338b27d142ba874f06a3
SHA256

7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503
SHA512

7ccee9b4cba3e8903731d34ff8fa786145735c663d9766af2763bafeb09307e239c4227d40c009fd87dc7c4256793454d018db6e8a86ba5c4c2cc453c6d51d88
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54wWR:V7Zf/FAxTWoJJZENTBWv36y5H51

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4860) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4732-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023589-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/4732-850-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe

C:\Users\Admin\AppData\Local\Temp\7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
"C:\Users\Admin\AppData\Local\Temp\7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
69KB

MD5
a163ba48152248fdceabb20f5ad7d41f

SHA1
e4370abbb11e9e905db3eb32abedb70160d174a5

SHA256
f2a3971b10faefca1ca1e9e4323a3cdbcec945164f651fa3a65720a44ba2680d

SHA512
43e4e0d83699894bbfb778334395ccd17861bd4445adb8e4986edcedbcb14adaddc036dc99a6ac662244f9e6ffed1d2827681acfacf98c803b4457cb48083afd

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
181KB

MD5
9b33ccce9fd4b41e04b792bab71b6c80

SHA1
cbea6e43c42279745738f2fefd82af02b8b65ceb

SHA256
3922cfef9107b12eaa47c5504d8fa77b2468ec188b5096b0ff7f47c536823995

SHA512
acdb43d63b500250f6955013f547d3bbef6c6604793cfe11bcb3f4662b88796b3b98874eabb4a2e4a42876b2f1065a92d65a46cd83a6af1d90ba6dce172db5e8

Download Submit
memory/4732-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4732-850-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download