9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2

General

Target

9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
Size

109KB
MD5

aed57497d961973973568cb5d1fa4bda
SHA1

7303d31829c3dffd8b7f4f79e918b4aa90b7f974
SHA256

9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2
SHA512

7bc86936c9ada3ef87ed4416bd7ff1dc79b5ee22a2bc4f17ee9fe9bae82775402d9bc2cf28cfa071a24a4c0bd33d1ed8e8421ed9ee889d91f0aed5a7eda3fbb1
SSDEEP

3072:fny1tE2tEtyKoIWbsHfySkT5GeCyi348oWGRPOzkjId6q8UdrSD+kCoIfL2YwqA0:KbEeEz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4665) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3260-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.exe	upx
behavioral2/memory/3260-650-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe

C:\Users\Admin\AppData\Local\Temp\9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe
"C:\Users\Admin\AppData\Local\Temp\9a08c60d5b03354210dc479f26500dd067d6f7182009e02504cf8f065c30aed2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
109KB

MD5
99cceb517b5cd0e0ecd72a828d25e2ac

SHA1
df843c88ebbba8ac11f19806f845d61bc21e82b0

SHA256
259bf54191374c303c500444413937d6c4f63e91e92c0ba66f17b9ca380979e2

SHA512
a6f2ff21cff608d903b4a08c828a423d67a090724e139a94dd9a99e7d86cb250b08d29eb9feb188026cd217678852dcd817fbc48401d7bc44324082725989b32

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
208KB

MD5
970424fdffc93bea36205a87a97a8773

SHA1
6495fb48a71b0fe6e90fa0f45b20c0ac914ece64

SHA256
55759919017f9e06c7ff78540fec1e3b0aea3dbf184d7c64b82b4fa2c9bd6af2

SHA512
2fc8f57a58435b4a1d5f8f628ab736bdabbd09d2701d4433781004b1e2398ffa5d167ff026f8e1b0db81db4cfb900a5b8f3f663a90816ac35c25b7a52d8e6226

Download Submit
memory/3260-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3260-650-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads