217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87fee

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
Size

72KB
MD5

1abf1cc59ce2e7319ccf8c2988275d60
SHA1

f6fda5641f252ed1660502b9a53d9a801abb8649
SHA256

217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87fee
SHA512

af1db3594f0d6e2757336dfb4495a69c3e2d272afab2665bf896df2053cb2d56b48ec019d70656bbe7cfc6489b1fdb73bbb2ad6c283a152b86ade69003318578
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r5:V7Zf/FAxTWtnMdyGdy4AnAJYq8Yqb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002340f-2.dat	upx
behavioral2/files/0x0008000000023412-6.dat	upx
behavioral2/memory/2388-870-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe

C:\Users\Admin\AppData\Local\Temp\217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
"C:\Users\Admin\AppData\Local\Temp\217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
72KB

MD5
d951d52c499798333cdd9a098dad9d55

SHA1
aea125a4f995b9062e00eef4aaa01654d2634edb

SHA256
fca44e1cbef0d06d0973949c571e989699b717231b873da8d012f7ea400d12cd

SHA512
59846c0764cf818e8f245752b890ce4f2deab9bec131935954ca551082931598300b504dc6a2e202b44c88539835c7dc0a5a8d8faacb0724e1c5087aa93afbfd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
ebc49cc3b81dcd78e9bc0294498415b9

SHA1
b61d7b11a737808949f060751d9da14d0eb7aa6a

SHA256
b8cc937cd40a73d44ba7012f99fbb01259fad60d272d6ef42a6800a69a296a4e

SHA512
bd5d27f3456a2f80bd0024247e376f2b75292f0132a06a0e9df3743a4c90cd40c85c1c76630cab759e1bdd83796e902886d40b471deed8ac7c2f75f606db3f8f

Download Submit
memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2388-870-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download