f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 05:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
Size

160KB
MD5

09446f307d37b0c94809d36d34e037a0
SHA1

28051e1adc54ae732a0b4ee02b359c36d7774754
SHA256

f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0
SHA512

662c74f368a2dee123ce3f76120f5890487328589d86be90531cd24f8337021dc659c8ad55bc69d83af1717d836fef643b59864acdc7101fc4a8bd8dd37a7267
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgLrdqdDTWn1++PJHJXA/OsIZfzcn:fnyiQSoFcPdqdHQSoFcPdqdy

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4824) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1404-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a0000000228c9-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/1404-792-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe

C:\Users\Admin\AppData\Local\Temp\f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe
"C:\Users\Admin\AppData\Local\Temp\f8f2c911ec95e3fca35db5d77defb89a21aff88fa218cd60ba4e2b90f38871b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
161KB

MD5
68316dabed06271eaeff014fb0f9eb4b

SHA1
8f93899f5ce2e9802885f4d3693c59bc145cd9b0

SHA256
3e0ed5ce75914834b865c2dd81c9474159210fe915174bfcbaf9fb4e030d1ca4

SHA512
48faa4ca2aaee864b2f47b42da7a99d8237762f9eceffaad3f1011a6b1e5b430776a967683f1adbcfd5f38fa20ce791a325fc6253475cf5dc60d8f98807ba8c8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
259KB

MD5
051efffee38eeb0e682251a2e9bc4bf6

SHA1
5a6d72d18c5fb011c947b73a97c762a5dc2f92d5

SHA256
55f32cafdef4206d300b2f0f7b3299f3d6253e89bf82cb512b7cc3642b8ccffe

SHA512
2ea45ed46a9aba417afb93b701128045818730446517321446484a68feb287e93c508c7b1e7b8f090ee33c9aa5ed7d2ac1b56b2b88921d696c6da6316f488e65

Download Submit
memory/1404-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1404-792-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download