af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31

Analysis

max time kernel
95s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
Size

145KB
MD5

8d3fd510ecfb8a4fe1266fa96b935ca9
SHA1

c84f8f5a8045d4bdab49546f066a9f6bbbbb07b2
SHA256

af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31
SHA512

fd5198ff3f661b08974cfabe02f32377c1bd20098a16ad8bc7ab526779c450eff2b2fa3d0e8fca48ecbaac761a2e023b7febb783df8a4da91ed020b8eadc5774
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJz:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuR

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1688-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000d000000014909-2.dat	UPX
behavioral1/files/0x0002000000010481-6.dat	UPX
behavioral1/memory/1688-20-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d000000014909-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1688-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe

C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
"C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe"
1⤵
- Drops file in Program Files directory
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
145KB

MD5
6f0641a65b7038454a11e70b6c4a3674

SHA1
7754d14874e46f9665c71a10f2ca92083a815197

SHA256
ffb6f911d7bf394e0f62d348d28c15a2c6a453a0b0236e1823eb0abbe1dd89bd

SHA512
e7b66cab5e765ea82e47d96e298a89fca55260eb32be3282cbf98b942ca66ba9e75684e83b797185707ab8880df280eecd6ddc1e3a81a3112592145705a5f68f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
154KB

MD5
80e73e105c9ed6f159ab4ea58256858c

SHA1
0065f66b3bb2a107974a0c1a48cbdf386a7cee0c

SHA256
073306badc2cb626ed77e50cd6fce95c2cbedf9a31d40e37ec638712f835f9e1

SHA512
f84be7056392fb537325bf9862d106b138d495dff8fbde1998a31375affed000af34e5924961536505bf7509215a5a392585fcb31020471e1185334f3ef6d50f

Download Submit
memory/1688-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1688-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download