c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbd

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
Size

44KB
MD5

2bca05fe80222eb6d689e13e92253940
SHA1

bb843fc8e5813563e7807d96940469d762031a86
SHA256

c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbd
SHA512

bd8dcbbc20ad5d67096c0b76682ce49cbcd3e25021aa9f7550d10d6fabd5305ac386abeeb60546f6cd73362608c42ec758e88d5534008c86e8caba4d1346ba79
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKvh/:CTW7JJZENTNyoKIKJ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2088-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002361c-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/2088-921-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe

C:\Users\Admin\AppData\Local\Temp\c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe
"C:\Users\Admin\AppData\Local\Temp\c181148fee48b9babe26ed71afaae08cdad5f022b55d9a32b66ce90f9dda6cbdN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
45KB

MD5
2bf7b0860cfdeb62ded30621592356d2

SHA1
04a1f77959de097f7f0c942490311a3729aa5108

SHA256
f1bcc67fb5115edfa66b81e14ab17e5d3bdd10a5b3e5c781b46d1e7f0d3f20e9

SHA512
8e7ca271e1d2c63caadc4525797f965491c9a29a16dda4c43b2283eef2748d9e5230245af5280ead7e67f3de37dfe13f5f6160c55a6ab5c9695e0effdd8e0fd6

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
157KB

MD5
06bd4948e3ddd463d0aebcb87acfaff1

SHA1
1077861a1de3ac0099a75273a4fa38f411c24356

SHA256
86a5ee53d60e32b8e3005ee5e0f9f81165d42bbcc199256787b3e1fe5d576c09

SHA512
f7e0622ef9637740eb8a50887b0f5debdba1701ee5b70026b3cf955cc6421907bd584805bffcdbabb8c2fa4b9bc9adf7e6a21c28439b9bfebfb90de6b5337f88

Download Submit
memory/2088-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2088-921-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download