8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
Size

121KB
MD5

08526595716d52bf9f6ef50fca514fa1
SHA1

1cc99a9a07d1e785d08bfb81d84e1ae7827063ba
SHA256

8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146
SHA512

208889936298d0cb5bfa94f3f27dea0e1b1f0644c90b3d625cff6ecf73a75163acd019443705db731054c6726ab02297cdebfe599e47145812689e74a165d332
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCp:+nymCAIuZAIuYSMjoqtMHfhfI

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4842) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4028-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000b000000023b86-2.dat	UPX
behavioral2/files/0x0008000000022969-6.dat	UPX
behavioral2/memory/4028-1664-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4028-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b000000023b86-2.dat	upx
behavioral2/files/0x0008000000022969-6.dat	upx
behavioral2/memory/4028-1664-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Google\Chrome\Application\debug.log.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogo.png.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe

C:\Users\Admin\AppData\Local\Temp\8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe
"C:\Users\Admin\AppData\Local\Temp\8e4f94f87946f63851273d193f52cf887689ea49d9300e0f76567204bfd81146.exe"
1⤵
- Drops file in Program Files directory
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2818691465-3043947619-2475182763-1000\desktop.ini.tmp

Filesize
121KB

MD5
6dfcd9df5cfe63e86be67c571fa83e35

SHA1
272bc1747d69d49931221ff027256ec51786e1af

SHA256
721cb77ac7ef9d76b549872ee776ef2e5f3a0536b925062f007aed0df0e76305

SHA512
7c577a07e9ae255b98769d867fa67b3e1cdb23df88698ae57eb6c72b53d1f0e45d7893a631147ae16cdc23d4d7cd3407714ee1cb738471113b2bca13d7c5e05a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
220KB

MD5
d9583ff579b5086b6e2ee01c62c1f8d6

SHA1
6d2c07978bb4a8bc7e9d7403648217a493a8e6c3

SHA256
f56b15abc0649008d970bb72948a6e1ac92de644ae49dc86509e24ff485b07a0

SHA512
43ab12ea71143d79bf0df9ad108ca28897d955e6b81c50b28eb881901a05767021fc1f82c21badabf491e0d32093893115afec841adf769fcef8b0b4694f1487

Download Submit
memory/4028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4028-1664-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download