df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
Size

119KB
MD5

220b8a1c62aa1f046189b598d98cc0b7
SHA1

c433e04e39e736ececfdfd95a7d48d787f54e1d8
SHA256

df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e
SHA512

8e3e8353f8c7e7e19a67fc68dd900598d26f3b3b65903c20926c307597a04b25baf7ef871d1a30c00a64fd1597d2adeeba1407943d5156bf1b27bea4380404e6
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC5:+nymCAIuZAIuYSMjoqtMHfhfQ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000c000000023b66-2.dat	UPX
behavioral2/files/0x0008000000022969-6.dat	UPX
behavioral2/memory/2220-1762-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b66-2.dat	upx
behavioral2/files/0x0008000000022969-6.dat	upx
behavioral2/memory/2220-1762-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Extensions\external_extensions.json.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe

C:\Users\Admin\AppData\Local\Temp\df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe
"C:\Users\Admin\AppData\Local\Temp\df746d59666a1ec1edc8a079770e49987efeebe1103058ef8a7fce871d23f51e.exe"
1⤵
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2818691465-3043947619-2475182763-1000\desktop.ini.tmp

Filesize
119KB

MD5
3df14ea46e4c83e2b93ec557bb35db89

SHA1
031978ba8f7edcb1edd2d40470c6dc7ec82603e2

SHA256
5361558b18c4569d9c7f0e30d328eb071d5e87bd4d49d6b032e296f216cd5746

SHA512
7d74796aaa138fa7befdb4e88806537c818f56f52c537d6d3ef52f3d68b12102d4acd71a29fb16f2eda926aee71e8c440a5c97e8179d73841e3418ef1f006749

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
218KB

MD5
64bc8055b57a1e15e87856313e1ed80c

SHA1
6910a36e38e36cde5584280f402fa80c0a442071

SHA256
e5e09867f56ac2a7b7ea87139ae7c4ae5d43d559a5cdfcdbd5f15392d77d3bbb

SHA512
e96de13f3c79280a3aa6baffc7d8f163dc57b8a4c84dd753c5f442a51b5849800afe5548beb878d7951a366d49f15881e66216d3f378d17f11bfe18c390d7c40

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-1762-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download