fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
Size

47KB
MD5

269f7626dd29bbbbc90bfb17b1f2b5fb
SHA1

ea9fc8edd2c06187768c78e093b545f57f287073
SHA256

fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae
SHA512

c090f71c69b7cd34525a6f0e0729cbcad2b003facb18803b341a2a031adc37ecfe1968b42f61fa50681e32ceb8581e8beaddf7c4270409c4ec4aa7d9f8e5d870
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdi:CTWUnMdyGdyoIOIZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2540-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e4-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/2540-863-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe

C:\Users\Admin\AppData\Local\Temp\fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
"C:\Users\Admin\AppData\Local\Temp\fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
47KB

MD5
d5350f131897c94ad53610fc6deb38d2

SHA1
a7f19c44bfc16162c0b5f42730ac41a3d9884ce8

SHA256
b2afe66c45e9f86332eeb4adaa96bb8a536381a8aebb8cc5f92d7534df7a2543

SHA512
01737aa454731ad5891c681d4c281268169608358a3ca75e742eef17be25199bb0cdbf1b183861c7a89fd7f78c708d904a38ad5b2fa7342e224ac174519ec883

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
b209c80b2d0282a3f739c0c40d20d626

SHA1
65303433a6980e290ce07c2ac08c2709d74a98f4

SHA256
139ece0c458e1a2f74635b8656e151a7285f1953a5dd372d74786bdedb8496a9

SHA512
a465a5d2396adf5586d2f96e3e34dbc7bd66f5534af3c118037855a8dc99bb99b71c0dc86eaac486f2e58c66dce0f3506e68e343da7307c3781b97a7bebc1625

Download Submit
memory/2540-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2540-863-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download