258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b

Analysis

max time kernel
149s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
Size

142KB
MD5

6b36d36b1b38a8e08598fc496e2a6211
SHA1

b4602285be2e116b0ca5633494163482248be1d2
SHA256

258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b
SHA512

187a61f02bca1e0b1b38eebd578a3d42432686eaa17a678c7f50c9f38d4660f52203d6f60ccd037fa08576c624194b25b5119f73df4ef9f6297bb6bd510a8858
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCm:+nymCAIuZAIuYSMjoqtMHfhflixi7hZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3888-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000c000000023b41-2.dat	UPX
behavioral2/files/0x0009000000022970-6.dat	UPX
behavioral2/memory/3888-1688-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3888-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b41-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/3888-1688-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\zh-TW.pak.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe

C:\Users\Admin\AppData\Local\Temp\258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
"C:\Users\Admin\AppData\Local\Temp\258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe"
1⤵
- Drops file in Program Files directory
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
142KB

MD5
b1e4b30baead59e94b09709aa09c0a5b

SHA1
bd86319872d44433d66508f193a3ca28b78900b7

SHA256
8dc5c53ab7887a1dd55929e64cdd8791175ecbb86116994e8b294cb408302055

SHA512
95dde045ce86348a763bcd0870368510eadc2fdbe5d6b28e6b7ddf33dc75399671aaa6de51b3bf569d0027a8bd004595a399ed0ec856ed7aea1fe7bb1a4ff874

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
241KB

MD5
41477ed1c204b1aa2f70bce1647d7776

SHA1
35de6896363c84cc86da7e968b27bb164b1dd40a

SHA256
0be7ccb18b11b44d9b42c89f846d619243574181712d878a9ea3a2603203a050

SHA512
22b869748920ae8f1987a9c9c8537dddfc03d2f43a929bb5813d84c8755db4c42b4f78e7e7576a03c5e71c689baf529754a721254f3c959c5cdb06a292909103

Download Submit
memory/3888-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3888-1688-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download