097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
Size

28KB
MD5

6a76ecdb4a98579474490004a2a67580
SHA1

5a36c97f24b177a96e4df0e1c8eb63e7c9a8f4a8
SHA256

097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1
SHA512

dbb7a4a702148ab9174815fd74fc3bbf60bb7d722d388a86eb152582145b9419839fc36325dce0fb5c056f794a8eda789e9723af64bc2d42a1d158cdd80b2a3f
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9UwNrH:CTW7JJ7TiwNrH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1524-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023463-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1524-1026-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe

C:\Users\Admin\AppData\Local\Temp\097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe
"C:\Users\Admin\AppData\Local\Temp\097cefc1a6263d78b81dbd8f6547d1df527919e5b66bb1aa6bbe29de4c3c44f1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
28KB

MD5
a75bc9bd23cdb5d4bc0f26fda2c1bd63

SHA1
87a856fc71e2493f8aaf989a76217752a09aca38

SHA256
357cd8c28a499f827674c33561e0934d38cd6a7b752880a117421b5383e4150b

SHA512
66c353082308e383e26c4d097c3e2a97ce55acafb6a20937a6efadc7376c61ce128cf52bc996546b187c1702c94cd745abdf2003136806249d65d8bec90d8309

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
127KB

MD5
77cbb4aaa06e640e826d038f65c62542

SHA1
f3203512d1587ceeb9a1790b59d2aa89941f7f3e

SHA256
4345a74ed83c9da9c36b50baa6452ae8017252da053286e5b3bcdf50b778666b

SHA512
610f499c3a1d79704cdf22bce5c3e246a1b2503dc2990b318c932aabb608c7b31db049ccb4eaede16191e3016e41e3a787a788ccee125db5e47483ea7da9958e

Download Submit
memory/1524-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1524-1026-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download