1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaacc

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
Size

93KB
MD5

5c2c63b1337dd3fe43ff60f0db15c620
SHA1

03c33746846b870d512bedd468698f03eef60e47
SHA256

1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaacc
SHA512

a3af22768990db38632d28e92830e89c17a83bbe791fcd5079f849955ae901c75d9aafa163a55a4980131ddcf1c281370432ccf230ed5d67959d6055008e087d
SSDEEP

1536:V7Zf/FAxTWoJJ7TTQoQ2TW7JJ7TTQoQO7C5C7C52:fny1oRVoRC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023455-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/448-840-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\ConnectOut.m4a.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe

C:\Users\Admin\AppData\Local\Temp\1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe
"C:\Users\Admin\AppData\Local\Temp\1ec0d3b11b0fee5d0512cbc07a04403c493db9144fd3dea897526596ca0eaaccN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
94KB

MD5
f167ac101bcef23a3b480aee698acac6

SHA1
ea36acea6cf5ccec219e7b10a51e3416abf0f7af

SHA256
7e37c142d9b3278cc9876a2537c8c2872d8cd1cadc42c1dd3ef9420cd4c8b453

SHA512
4ff13caf872c6874977f1a11d171136a9d5caf72bccd3e0d2982e93d6bf00c18716c5ce87f2aa60646582dc47bc6bed35e12aa9792c093dc93def0fafec3ed15

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
192KB

MD5
1c7de4ad1698e7f6fd4461c3cc5f9779

SHA1
9bc451b1eae8890b4e4a4b79db9c00057739d913

SHA256
3d83b47de7485f85ed582e8199210259d31853c190430590d3260f8f5504bd69

SHA512
833e9c9c1ef2860aee81e95280a641161395c35f7f463daa48d28eb3dbec4d66aa7692aa96107a42d9b661ce90a4459276c2d326461462d21f019ce87930f1d5

Download Submit
memory/448-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/448-840-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download