c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
Size

388KB
MD5

f1f77d7e7bb726ba4f847d5b6fbf91e0
SHA1

5926e6a7f73d3d1bd1643c7b6bf4196fe29de157
SHA256

c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310
SHA512

c6204ecdc5ef8b1fcc835975b45e53cfaec527e56758bbd26813da77e9a367adc34fac1ab062a465bcb84640a0e73497b189cd58747bcd1baa53bdeb1533b389
SSDEEP

6144:KbEyyj2yAIJbIjNDv0bNXkbvLiPOEyyj2yAIJbIjNDv0bNXkbvLiPR:WyAUbIZGNXkbvLLyAUbIZGNXkbvLK

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2762) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2708-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b26-2.dat	upx
behavioral2/files/0x00040000000228fe-6.dat	upx
behavioral2/memory/2708-599-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe

C:\Users\Admin\AppData\Local\Temp\c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe
"C:\Users\Admin\AppData\Local\Temp\c119aca718ef0ce2df42ac829ef50953b741c46856d9cb32693ce6ad7b64e310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
389KB

MD5
c39bb6773a39e1425f5d45062c474575

SHA1
230a4189643923ee5e7c94e4788b01746a4e2832

SHA256
1e703e6af06a387df123c4e871e3133d571241629531a95e94e2d0dbb872fa90

SHA512
ba302200f7225ddf8ff5340edca4e547e71a8efb3fd668b234e07884e8cab28718fb770fe8928dbfca3404f026b021663214c828dfd105ded87b9199728acf49

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
487KB

MD5
9bd84f03699d03ff632735d91725abda

SHA1
58d1d7cf61b1c6b7a7ce24ea98a2b3f8489ef383

SHA256
abdd8ab1474cdc13645d4e3bb7463e555edf9cc05e091198376d2a474901c083

SHA512
93ab19e1625ed24e77c516a6de6fd0273eb147f7174ae1713cdb6d6b447a3f809ff8b0c8f53f74e751b67a9a1b718531148433c8190a1746185196c76ebde53e

Download Submit
memory/2708-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2708-599-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download