863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cce

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
Size

46KB
MD5

0650dd4f85e24d53173b1b639601e8c0
SHA1

7f28fe752ac71e9875a4fad62e4a3cdbf644ec9f
SHA256

863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cce
SHA512

9b3b8cff32b4b708c04810acef6a5adaa4e02d53e93717362c4cf5a788e35df749c6ea8276ed3d6dc5cd72176d7754ae711c2a03fe284ca545aaee5a528cb05b
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiQ/Gum/GutX1vqX1v3:CTW7JJ7TTQoQE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4416-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002346f-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/4416-987-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe

C:\Users\Admin\AppData\Local\Temp\863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
"C:\Users\Admin\AppData\Local\Temp\863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
47KB

MD5
f43fe72d82023fc858b0662ea6c95de0

SHA1
3dec3ca6158b536e7347b0fc01cb69f703c6e903

SHA256
d6651ff49425db0f6beb9991cc1397a071281e35cfeaebdab59c5b9c4e965566

SHA512
97a94290559843344b7d936a5d74c473da82d806fbb6f0fbc7508362b5b0d754df0cbc308db1de9fb49963a5929745b47b87dee671276ea9f2e27f51af3965ed

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
92d6e53a8e604ccf8c2b056034141793

SHA1
693dac34d5f695e98b622c41c973c3732727c61f

SHA256
2df6f13d16d5d594a6172745ea81a31e33a0b5416fa11cc174b74af8dab926f2

SHA512
0996db21de514f8667c2c967be04ebb876ff00fb5f0f196fdcfcf2791c68c36cfd9b0149818532db7d076dc7fd3b673de0fdd4dd04306e5b6b4dbd800f3c6aa2

Download Submit
memory/4416-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4416-987-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download