833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdc

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
Size

46KB
MD5

0c8f3423de6f321a7bb483d367ab4780
SHA1

6d034f9c5ff37844426952ec9d532ffc481315b6
SHA256

833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdc
SHA512

6e9f3112a3475f374bc1ffc1661d7410f72f74bf0ffddf584f674109aa2079f6916bf1cef008fe689f5b2477ced7c3155edb651f0e3e0838225ed7a31d37d587
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Ajs:V7Zf/FAxTWoJJ7T2js

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2276-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023455-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2276-896-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe

C:\Users\Admin\AppData\Local\Temp\833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
"C:\Users\Admin\AppData\Local\Temp\833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
47KB

MD5
67c23f90b0e46f57705e489f34a99c87

SHA1
d60d52e098a4f37f09559a0e7ebbea382a0e0dc1

SHA256
a1f8bfbe8d596902d8d6cfd1a4e7d38ab2fcbfec5ff5358abc38b44c1ccc4b45

SHA512
4f6fe5d1ea7568e1b22ac51b14c90dd137e812b757b38f28a38acb91329eced67fa56a2e92d1928e4968b279b7f8f1242d13e4566e0abde9124578810060df1a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
e8306c377418721a140623b4ba691838

SHA1
b7dbc8df4f94cddb95b8cde7623432b007d41141

SHA256
17dbb6b7f620015edd954c523fdd792f1b56a6111983da22e20f404c158d7053

SHA512
f58d3f603d36f5d83f4a99397ab36fde42dc88ab18785804916fac0f056ceecc7037ff189de28cd8c9638297aa15f5bf07f6644f0278f5a29dc5372aef63f7cf

Download Submit
memory/2276-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2276-896-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download