d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e

General

Target

d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
Size

108KB
MD5

ae15b66b57c4e82445e74b83aa38f2cb
SHA1

0a8cbe0d6bf33f7ca0a15dbb731f4aa0aca82037
SHA256

d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e
SHA512

5f97156db3fa6cfc93a3aeb1827818a3161cba3020f30293ea5f627b2394f4e36421ef5369c33601b11442a0058a808559825825b48eb5e5c782d81dc0739cdd
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfDPw:hfAIuZAIuYSMjoqtMHfhf0

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/724-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2177723727-746291240-1644359950-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/724-1054-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/724-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2177723727-746291240-1644359950-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/724-1054-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sr.pak.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit@2x.png.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent@3x.png.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe

C:\Users\Admin\AppData\Local\Temp\d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
"C:\Users\Admin\AppData\Local\Temp\d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe"
1⤵
- Drops file in Program Files directory
PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2177723727-746291240-1644359950-1000\desktop.ini.tmp
Filesize
109KB

MD5
ecc0ddc65d4bb5fb34c52cc52457e06b

SHA1
c9a8bb50f36f79721d6165eeab99f1a30d33744e

SHA256
bbf7fbd135ea0870139f7b762f7e75ae97dae4d91ac85b061b64a07f9d37c2dd

SHA512
0c9f83588509e50fbd2626ba254967cfc33116784231d645137ca4ef13a40aad5241f3720d0e4833d0f54955a0033f2dbd41ab42c106c8c012c5d4b160bf1d83

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
207KB

MD5
bcb830e77c0e4bed72fe11da5ed2b0af

SHA1
88db625e8061b4c388ea636e861912771488f0ce

SHA256
d7c56138e81e8cc36002cf1b2b80c9752f3f60f84549f773c6d7401a96cafecd

SHA512
d8c94654996bc93109282abee5f45dd3bd72360c76ee5c886649474fc19264f0067533ba7bb1fd152d09e1708c66ba970e32a9972e61103d04d0d865420ec7e4

Download Submit
memory/724-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/724-1054-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads