73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
Size

96KB
MD5

7d4db4bf4b920361a32f2b58acfef9eb
SHA1

70dd77dbf214eaf7a2f0a5403ef191b7ea00a709
SHA256

73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf
SHA512

5ce5330375ad264451900bb7cde19425b3fb13c888d2649b8e848960aaf5009c262f6107eb1675d5fc062112ea31b2e95e42cc35febcf15a8d42ba5bc64c783a
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfB+:hfAIuZAIuYSMjoqtMHfhfB+

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/5116-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x001c000000023af8-2.dat	UPX
behavioral2/files/0x0009000000022970-6.dat	UPX
behavioral2/memory/5116-794-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5116-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x001c000000023af8-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/5116-794-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\de.pak.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\et.pak.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe

C:\Users\Admin\AppData\Local\Temp\73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe
"C:\Users\Admin\AppData\Local\Temp\73a0b9f18ef44b99c83e708093319634823e5e5349007e36354fe08edc608dbf.exe"
1⤵
- Drops file in Program Files directory
PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
96KB

MD5
acf478adcde1804b7eb6385cae265d78

SHA1
1e8b23ffbcbad654c62ee67688ce97ac85a973cc

SHA256
9e405657da48132c585db66ded10dd1c410304a54658ac9196b16ac4c0180851

SHA512
f71f281d9f39f471c56d451413305d79d250dca98024182f5c9165b9dc7cf8be58347778b50c6347c0408b3caf65c7f000f13f8fc548dd45d32990b81693ad79

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
09467c3a0bb75195c50e50a63fdc4c24

SHA1
338b47428fe71af33c7e306fdfc35700ad4e75d6

SHA256
8f0f07821f8131fe35222ae281374e01e2dba9fd4fc9fd7bf66bdc925ef25130

SHA512
10de8548fabc2ef17d608bfcbd3049523c4e948373b282c8135d708868655ea5613080a294f94cfde162eb8070e922119eb13f7ecc58e1d6e2caabaaf790e3c6

Download Submit
memory/5116-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5116-794-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download