af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6b

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
Size

72KB
MD5

7cad2b4a723add5a53738029a997e5c0
SHA1

0564187b60a52b018f7fbd2e99e7af7b5bd09c93
SHA256

af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6b
SHA512

0c84353e023eb96f874a5b06fb46567b45c61abec6f069f2405a1e1dc54a132942bd7cdf2a14e4c558c0c48c2cd709eb1d03c9542b1b65a8caf372064ec96178
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY51lnlz:KQSox51FF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4366) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/884-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c000000023b26-2.dat	upx
behavioral2/files/0x00040000000228fe-6.dat	upx
behavioral2/memory/884-660-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\CheckpointMove.iso.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe

C:\Users\Admin\AppData\Local\Temp\af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe
"C:\Users\Admin\AppData\Local\Temp\af5c960fe53f244ff843634de18f9514ffb44fd8ec6cc3152478cf84ec15ba6bN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
73KB

MD5
186470d8e0ab968e56d603ce6fda9617

SHA1
66e7e25844dda1bfb9440783175720a3f80e5157

SHA256
93525c744b4a34e76fa1fef7ca6d60ad113c71f3314f454e746a609c7026d5ae

SHA512
5ffbedf724486dc16d69f4babdb43210b3fba35b416582d69c454e4bc903dd4033ae14128b050e4d226da3a385e94b7906a2121161f48e20f80580933f3f16b5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
6ec57e93e789bd24a3f6fe7df0689c09

SHA1
ac481e5d25e2078cbabf3f81e4624c5a09b1ac40

SHA256
8968b1c0e53bee33b27615e5b83bb22f2df1b7f2d40eea1366702bfa2c63f4ff

SHA512
85ebe312b780fe5eb99ff0f5dbdf4927e7aab0643eecefdc5e1d0f99099541b6c80d5963d4e0c93bbb48c521a7faa65930e1f707e6265be3af64c0f458740993

Download Submit
memory/884-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/884-660-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download