127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
Size

134KB
MD5

3600131e2c712af5b04dea74c972927e
SHA1

4a127dd626ad61075fdde04418c5a8f2baa1491b
SHA256

127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad
SHA512

eff8766a36ba271b6102d536767e0a20d0a57d51d4e1f589f43b44f2fa7ec0667935bbf7b080fcc0d2a1b11a59e276339cd2878962f9c557acc17d564a804b86
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC4:+nymCAIuZAIuYSMjoqtMHfhfqnXwXwS

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4842) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000800000001db0e-2.dat	UPX
behavioral2/files/0x000800000002295d-6.dat	UPX
behavioral2/memory/4936-1782-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000001db0e-2.dat	upx
behavioral2/files/0x000800000002295d-6.dat	upx
behavioral2/memory/4936-1782-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe

C:\Users\Admin\AppData\Local\Temp\127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe
"C:\Users\Admin\AppData\Local\Temp\127c5e93ee0bff6c2cec5ffc222dc6a5c233edfe3bf68e6d1f797689265024ad.exe"
1⤵
- Drops file in Program Files directory
PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini.tmp

Filesize
134KB

MD5
fca7ed88857fbd846e3765731e6853d8

SHA1
8546918445d200849c2f36ea6b92ed10817c5a8a

SHA256
a7a10f6b95425ead01e3af1b5f2a28447b9b46f574c43079a23f9d92fcc9ab08

SHA512
d640faed30bec2a05a6f382838e649c878d65afccd236aeea930a9a8e477fe1fc9f4f9ce17418081f12768698e1cf25ec28c22d8d35be5bfc12bff267a1681f9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
233KB

MD5
1bda786c079dff3ff6a6e662e186b5a1

SHA1
5c9d418fcf243f1e3779de9c350a102e4ed3d3ff

SHA256
3a1da5e127439210b219ed52c82a8988af0174d4244c8dff96d70ee3ec005360

SHA512
c591de2789a7904680f10cbe235ed7296cb4a1ba5eea6147a26913352964058e4052ea95f51dab411e517e89a897b7f30fd7ccb00bf589e8894d9f0b2a08511d

Download Submit
memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4936-1782-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download