286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8ca

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
Size

33KB
MD5

553fa76519666d04f56d990c72d9fd90
SHA1

c6e138b95ea3edae155c175daa5cc019af4a09cb
SHA256

286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8ca
SHA512

75104ecd39dd1ce243fa7f6048b5f9992d7e11b2b7d399a7c1c363c0c4528b8bd0197a5aa14786a89e763628000677af64acf2b705125e2a74f2b45edd6d5b07
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HF/MF/Orp:CTW7JJ7Tj2o

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023444-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/400-1019-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe

C:\Users\Admin\AppData\Local\Temp\286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe
"C:\Users\Admin\AppData\Local\Temp\286f88d985b33fc64a5d2842e3c4cc3e6f2860d362c9a8029628a2c8d2e8e8caN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
34KB

MD5
903cb2e5cb212354675628fc4d7a0a9e

SHA1
ee238a7a61d0d17d902094bfc78358106157e3a2

SHA256
f6754c22f26d7ac496a480d14111869b11175f2411a6988160ccef7caac96de9

SHA512
531b7f33bb390ba85baf067b22cdacb51c34b59d607c6f4eaedf8ab8dc4bf2e3ab6ca512e47503da96cc0d0e4beb8868804ef24f809e30b747e9398285a54752

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
132KB

MD5
83ba0989668d791378a9ce36843e9e25

SHA1
6515c1fdbca70cdb1f90af603a87d28ef7f67fdb

SHA256
4320e4fce76e89827779875f367220bb628cef960b7e25b75db3afa70cd436a7

SHA512
0bbc7d5b8f05f48d7e962d4b42928df0e3fb1e435f6b27ad8979b4b29710bc4d96e7e4474258baea54240ed5da6796b6d57f0ecb65352072df6c14c9ba361973

Download Submit
memory/400-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/400-1019-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download