9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
Size

50KB
MD5

a29aa5a05831a5ef9c4f1f28fd224150
SHA1

44b7117fed7d90d386486b7d8f28834c5f09fbca
SHA256

9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970
SHA512

39682b52d9ed6803b4fc140ea201dca6e99a1912d124948a5c76c247ef64f463349756bb0a03dfb6153204ccccbff7b6e41b4938c327d42b61a7f721203a7eab
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJXGitPsqAJUqAJqW5:V7Zf/FAxTWoJJXtPx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002349f-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3444-1004-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe

C:\Users\Admin\AppData\Local\Temp\9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe
"C:\Users\Admin\AppData\Local\Temp\9f08f921ae79e6c7ed67cb917f3c97cb4f5fc08762212de63296e80c911d1970N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
51KB

MD5
eed8e8b2d7567553545abc29ebc50ef7

SHA1
47cfdd493d01d4a0fc728eafe3d52002fdfa4bdd

SHA256
eac31e462d2b7110757c3f03454c5e34f882e38e4bd0b493a6eacaf9cc00fb1e

SHA512
0aa99386d03388e9dff2567217f409b4e26a0c1c5831cd428ea514e028151aa1d2344d5eea894d31cb85a3c4684ef11711c43ff9fc0c51e27d5a92e82a921102

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
5cc166728833481f7413edf3de14788d

SHA1
2fd62720977acc7e03c17a814bb2b251467fcfc5

SHA256
6e6336b853e34bcec887e8b5443d6839f50cc72c3f835a6cfca5783f21afbbce

SHA512
cbdfe19a8c301cebb4ba6ccc674bb2e1ccd347688bf1f605d3ac91bc10f191fee662167a0fd45274820972e3cc12c2e55f09151daeaa06a285ed23fa6f2b357a

Download Submit
memory/3444-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3444-1004-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download