e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0

General

Target

e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
Size

59KB
MD5

994b1cdeb29e449788b8ed4922a3d821
SHA1

b95d57ef68196ca73fea9b6341177f8808807891
SHA256

e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0
SHA512

e9f573fe7459184f25e4c060aefa54669704d38a368741ea33044cc52268a5bdfe6857d17c7e4f4666321e8de1ad194d6b6628343f59bd03d6236d4de17e6d1a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PV15Rd:V7Zf/FAxTWoJJZENTBHfiP3zemA6H

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4845) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4812-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4812-658-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ms.pak.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe

C:\Users\Admin\AppData\Local\Temp\e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe
"C:\Users\Admin\AppData\Local\Temp\e14c498dd7f8708b5c15f54535c416223e9f09fed68de6dcda8aa081581084c0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

Filesize
60KB

MD5
ba5e080201b11f4c42426f67a03abc28

SHA1
08cbaca07c222eedfa6e3139924f5ccd7e9dffbb

SHA256
82f1e638e7e57de55704265b5d4de321c86b34e21b0fc9e3e8d05957746fb4e3

SHA512
22df4c39d800fee57fe6ae9793d76de9cd3106ee9cae46099254f2d177a6964f9f760a8bcad971e82edd922ff63679067bf7a5c4631828eac07c40034e1615ae

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
583f8399d3043c5f3e87e4039e72ad80

SHA1
1c56d9882af4908a1b53e1881243491d26f6abe9

SHA256
8ccedae46eff42f947043ea8a2cea32170d9d1aa3839e469da69b3f092931dcd

SHA512
c67f5547c01c3ab8283297c1618a479ebd6ae107d4fccd39d2f9f6f50026d98715f91e31ac2615246ee9741b2149f4dd0ccd8e522a737898fb9873d1ecd8f28a

Download Submit
memory/4812-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4812-658-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads