04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
Size

129KB
MD5

5afa617219f27ca1f54afaf8a282ec19
SHA1

2b560d5ce29eeb448308581a81c5be00fb7f7aac
SHA256

04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe
SHA512

a2c1a411d2ca94d0825ad1395323e24dd27ca6236ab674742402a619356a620d8a6e4847ab4706cd2350e9a95d938f5d94811a5ab83e6f54e3d5a21a7f1338ea
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC7:+nymCAIuZAIuYSMjoqtMHfhfqnF

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4768) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x001c00000001e97e-2.dat	UPX
behavioral2/files/0x000800000002298d-6.dat	UPX
behavioral2/memory/1440-1766-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x001c00000001e97e-2.dat	upx
behavioral2/files/0x000800000002298d-6.dat	upx
behavioral2/memory/1440-1766-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\icudtl.dat.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\manifest.json.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe

C:\Users\Admin\AppData\Local\Temp\04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe
"C:\Users\Admin\AppData\Local\Temp\04ce43d107a3a882b6e77f5e2f73446c7021fdbbe2a00323f6238d3a6b408cfe.exe"
1⤵
- Drops file in Program Files directory
PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-259785868-298165991-4178590326-1000\desktop.ini.tmp

Filesize
130KB

MD5
08ddd38e8bef2a04a53af51a3d9ae0cb

SHA1
6667ebb68599578bac011513d2cd630742bdf013

SHA256
7fd6e0be9a2bbc0fd5b8291d5481c1453ff170ec7b8093111b0a225a9be0eabc

SHA512
e10fcf5f6e414a81aeb2950a35f07d1b30436d6ae4fe89500de6fc515c919b0432894ba2fa500ae9fae20874423bd71fccd0576143b678c5eba52168ec03dafd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
228KB

MD5
57d594e5a89c66e81471ee57ee703942

SHA1
9c5e3b511f7e3aa67d4d49bbfbce509ee4299e63

SHA256
9ae330894b29ad3415baa86c50efeed3dacb80fdc4fb260504fc9be415e74ce7

SHA512
549ec6556228e92f8b1da1858a4963787c87fd6adaa729490d967e70ce7f1e614732d8af1c75f97126c9941db4053d463c8e7e1e029a13f78399e1730607b140

Download Submit
memory/1440-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1440-1766-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download