f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
Size

70KB
MD5

7deae22ceeadba7573dc2597d26e3040
SHA1

2b61a552709ab7171f6f09658240ff5a45c9b06d
SHA256

f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4
SHA512

dcd7ac18b757c2aac565de24f2c07cbcb7c5dcf48b04045982a3e8cf94c03c60be5e2f913f9c8c0642b53c8d646427332170c925a592403622e067d813fefa6f
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzQ:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5fcU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4638) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3028-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002346a-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/3028-859-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe

C:\Users\Admin\AppData\Local\Temp\f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
"C:\Users\Admin\AppData\Local\Temp\f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
70KB

MD5
3044feee6084128a4ff72bc2385f7281

SHA1
d2fe9fbd73d131407b9c82f0327de230162ebffc

SHA256
53e014734a8c23f35cc00cecc2d47b07a43f973e62430afdf2440ab3640fd310

SHA512
956f4817aa58e89afd5704157c5bd9fad242e6061efe7038a346849b138f40b121518c68ca40dcc5f989b445f19f0a430d88c55d921a377bbcfc9b87cbb8876b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
d2555f894bb17671f7835dd6e8044e35

SHA1
65b610bd802b3acf182acbdb1be9d27fb4cca053

SHA256
cf67298d6fbe3efeeaf00f7050dfb3e3f5c5435752ace606b59e08a615b3248f

SHA512
cfdb1b38340d57cbc234262850f6351d8f8fbcfe8059c5bf564cd2230f8910e986a9657fc35dd26dd26d337e33a316efe545f7741e51ae52f00ebd542ca06f49

Download Submit
memory/3028-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3028-859-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download