9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
Size

25KB
MD5

5b73fa96512db9a9953af6551a8bbff0
SHA1

a74f2c7f5ac968082b5fa2b7b2cd33be7d978bca
SHA256

9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7
SHA512

f3dd7f0f5e8cd0b703343ac1bea04ed91919100f1badde4d4103a43e4bd140275e664af841709fd2f453f29f944d85ab0c36024191b0c13a4e9c52be521bcafe
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9AiOiA+c+N:CTW7JJ7T9

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4336-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002342e-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/4336-1081-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\itircl55.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\odffilt.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe

C:\Users\Admin\AppData\Local\Temp\9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe
"C:\Users\Admin\AppData\Local\Temp\9c6ce897f3d3c9d0e1f6774022cda249474489734d7609335d178f510aa687c7N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
25KB

MD5
e4d90c699b8adca276a747131c1b8990

SHA1
f1fdf9a70582722d4cd5237cf781ef5e531b3de8

SHA256
918388d3df422f586f25954711df01109344cfa96fb39218b5da293b3800306d

SHA512
be8f1157fe55841c9257337744098c0eed627bc46b0f56e98d929f4275a6c8160edc0332642a43cbb0f1bfc5e7c131653fdbf241a912ac96b2ec3771f1aa9adb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
124KB

MD5
a635d6366edad9ca6e2ce953dc7b38d9

SHA1
6f3f495822e119833dcb3c45544a6abbc3798470

SHA256
a78dc125060f60b4ee3399ef6e0cf68581d00e76734b807be7a2909673d74e4d

SHA512
1aa3782ab7898b2c23eccd22961f94725efe82b7f179ceb9d7ac8e37414b58e9d5ddb5dafdd8a1e88a785136512c51b074e04613740ae440c0b233f96b228bc7

Download Submit
memory/4336-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4336-1081-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download