0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
Size

38KB
MD5

cb6eb6b97c1a7840f34633e0a9f5ffb7
SHA1

2f405c2943e375550a0fe872b113c1cd706a8a85
SHA256

0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f
SHA512

5ceffe62e52f199875bd6e701b28ec09e259fe0a9ba0dd24cdd8dca6006798242597cfddd3697c4dac5575ca0989aa554f1681419ca4574196e7145c15e20a97
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uA2:CTWn1++PJHJXA/OsIZfzc3/QP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1788-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000b000000023b7f-2.dat	UPX
behavioral2/files/0x000800000002295e-6.dat	UPX
behavioral2/memory/1788-792-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1788-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b000000023b7f-2.dat	upx
behavioral2/files/0x000800000002295e-6.dat	upx
behavioral2/memory/1788-792-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fr.pak.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe

C:\Users\Admin\AppData\Local\Temp\0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe
"C:\Users\Admin\AppData\Local\Temp\0a8d58dbc4c768a41231603ca4058c5c0b95a41b1335ae4e7c0c5ccf6584f78f.exe"
1⤵
- Drops file in Program Files directory
PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.tmp

Filesize
39KB

MD5
61cb5a1f572168747e82ee61c23b31e5

SHA1
0b0d0f000a207a63f2d28235ca89c555bcf8d16d

SHA256
a0a5eeb97bdd825715f1991f8db86d5361fd51a0d79e61f7fa1807a1b32363ea

SHA512
46b80d95462cb4eb9242653ad836263b585a4805be51010dfad80e918c90c6bb147b05f51b14ca59a6c2acd7c276e518f1da41dc5328c4ecfa8306cb9911ac30

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
26cbcec683834195184d983f5255b81a

SHA1
3c1f29216401290cd096fb6058718f66f352d598

SHA256
6ebb9768eb16b3255d9d1b9b53d022412398c8d1cdc0e7410edcd1736b97a2c3

SHA512
648367ab1154d14b94ed59f10561d3e2780059f25809a11f8070c1e03b0e976a92300796c92b804b510edbb0b4360796279fecb5d8110c89403aa0f54a37ddf4

Download Submit
memory/1788-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1788-792-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download