c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
Size

103KB
MD5

732d6753ac272af56e6dc3715ad2c9b7
SHA1

830cb75e23f854239864a2e21e317376f4431cb8
SHA256

c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b
SHA512

42cc3c2dd56c59fdf67051661cf21918125cc0ff7349807a910b889a03793b089d5d1805cb59ac04778a7574225fad8ff76955b56eb6b4c1a290c2327fd80aef
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf1Cc:hfAIuZAIuYSMjoqtMHfhf/

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000c000000023b47-2.dat	UPX
behavioral2/files/0x0009000000022970-6.dat	UPX
behavioral2/memory/4436-810-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c000000023b47-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/4436-810-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Resources.pri.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PEOPLEDATAHANDLER.DLL.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe

C:\Users\Admin\AppData\Local\Temp\c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe
"C:\Users\Admin\AppData\Local\Temp\c33a5a3e30f83843f4fdc16d4a78d3a672bd150ed1dbe392531e2585b937990b.exe"
1⤵
- Drops file in Program Files directory
PID:4436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
104KB

MD5
b88ea073186c9740c01d16bcf201aa77

SHA1
e2b9c56f16d34e7fad2e7337973c444225e33362

SHA256
34c04be4a016a3ab628fc54bbcb24e874bfeebb21afd9294383f4e8f8de4ede6

SHA512
b511059a5c9adb829170a4dd6fb64a9ad19f7de826118bf2bcfaa1fc82a940d4bcb5f5d023fb1f9b63b0a280a73a9133921c2fd524a13221d9476d347fc12ae9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
202KB

MD5
a51316b4dc11f68aa4bdfa6d37f9df23

SHA1
89a37c21d4f231e07bc37816c0129c90f76ea4ad

SHA256
c01b8db1af4acd0a86c208d621e8f6ef01f3be1e9e3ab708ea68d156d9db6f91

SHA512
7449c2a63111a549a063bedf9015c356b628bb949ed907ace99d7584f16e397e255571b346c358d332a0cf3f8fff7330e8f8bc2f961bbd0937f8c76d83e51131

Download Submit
memory/4436-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4436-810-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download