443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
Size

262KB
MD5

6231ea1da991cb65948d7a9ae2c3656e
SHA1

9da27515f6cac74782c06c901c22fe33dc24422c
SHA256

443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762
SHA512

edad0e519d5a046f1f7ccdf5faebda56fa60eadc3da2007d1187ebb4b94b6251a18aa376df617fcd82aa9a43a35ab4d9067e40b1b1dcb9a512bc85936d1ca83b
SSDEEP

3072:+nymCAIuZAIuYSMjoqtMHfhfew9mHpKZNGCLOwstyhZFChcssc56FUrgxvbSD4Ub:JmCAIuZAIuDMVtM/D9UpK7ShcHUaZs

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4440-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000c000000023b78-2.dat	UPX
behavioral2/files/0x0007000000022971-6.dat	UPX
behavioral2/memory/4440-1538-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4440-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b78-2.dat	upx
behavioral2/files/0x0007000000022971-6.dat	upx
behavioral2/memory/4440-1538-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\de.pak.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\ExportRestore.aiff.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe

C:\Users\Admin\AppData\Local\Temp\443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe
"C:\Users\Admin\AppData\Local\Temp\443398db06a4017010e37aa7b3d2c9ec99150647c60a80ed867aca53666b1762.exe"
1⤵
- Drops file in Program Files directory
PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini.tmp

Filesize
263KB

MD5
492f6deb122274d29a6f031a94d86842

SHA1
0a75e021fcf2f9391e821f9b33eb994a255931fd

SHA256
ea91ffcf8261e5ef8eb65aa33b9e1682cfbdad49b6c1368de152172fa0ebc1e4

SHA512
78e7d681d93d3f2d0f70a1b2b89c349496e35ae8bcf74693658d407c0dfd3467df7c042f3e7d26f808a4811796781b3af4408a08f2b5c75149a3b75368847a96

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
361KB

MD5
cb68496a1658f62a075c3e00e64dcce9

SHA1
d01ba11fa08367927dcce999050cefbf2174cd2b

SHA256
aed39270498ac894b2df2d0d103d442dfe49dc09d40d30f8acafe3af2477837f

SHA512
020f2c65b9d38981ac55ed706bc84ce2eb042443d05c97f7a990e5111be9e2e53dfe8b487433d66dd0069444efd63f59d3075354df7b394737eee3c97f10bc43

Download Submit
memory/4440-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4440-1538-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download