9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
Size

61KB
MD5

6e6dc34e7f5c5b888538e0c2a0975733
SHA1

2e617c436517a26b4dc2c3b8643dc3918d355b76
SHA256

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51
SHA512

02f4144e3278c8287de980c243fba0fff04b003c3b9c662b53830f470829a9a99737cd78710ad909c5b544aeb87c9f7c851ea52242e62d12f6d6cd05e84890e4
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sw:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/QE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000d000000023b2e-2.dat	UPX
behavioral2/files/0x0009000000022970-6.dat	UPX
behavioral2/memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000d000000023b2e-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\v8_context_snapshot.bin.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.exe.sig.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxn.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe

C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
"C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe"
1⤵
- Drops file in Program Files directory
PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
61KB

MD5
e99290516681035d0a51cc06181ce394

SHA1
a374d127024692636aeffada228f7d5f29127978

SHA256
ae4824022dbbd9cfa02f8e90ac9840ed26b7b94c5f4613e5f14827c4ecb652f8

SHA512
86a8901b90681d430633a63b3444d19be1ff05fdec7d6c81c5f4329cb92c03e16be4536dd03a402df3ab3de7a9c3bfb719f7d6b216b2ea4b833a49b5914906f0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
e63027b5b46a775518ce0c57c317d5ed

SHA1
de122cfed92843fc4d621e4c68a356bdc6e3d621

SHA256
4f9691b0d01f6e8ef79d5b390557497120133d9bca6c29e22949a96e29307346

SHA512
6c1a87d365edf077b1218b6d30c63bd9112a2c6ef548d4f6eff8916c07bedecc446260aff54db2932953d3a1942dc5191ab98133c5858d26d8efde60ce7382cb

Download Submit
memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download