f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
Size

129KB
MD5

de6d118629ce3702ef44a0893fe9d0f9
SHA1

d1db3437ab6acfa32072d3345af1436ae3e5c5fc
SHA256

f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da
SHA512

cf0b7fd7798ea9da6ac565a6485f78126f5f91242c35d96deb0e5b0b327beffa7c1c88ada6a828de5d897c114d72cb2ef844af5142354341018d1091f7a7ef27
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCl:+nymCAIuZAIuYSMjoqtMHfhf7H0WH0X

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/552-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000b0000000233c3-2.dat	UPX
behavioral2/files/0x0007000000022959-6.dat	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/552-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b0000000233c3-2.dat	upx
behavioral2/files/0x0007000000022959-6.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe

C:\Users\Admin\AppData\Local\Temp\f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe
"C:\Users\Admin\AppData\Local\Temp\f8595408c8ad3ea9c683b963b1a50943e79e795e4b2678ae20b50a5726f4c7da.exe"
1⤵
- Drops file in Program Files directory
PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
129KB

MD5
3dc371281193a7c8aa437f2f6d692411

SHA1
e5c9aeaebbc3390e20abf5db246ed8a786b13024

SHA256
20e13585a8ce9815a7058cb4cd2bedc7028b6a8eea53c03b270a03f0e7987b42

SHA512
33c45507ef13bd6d2b4a52b147d8b7a7401e7d80dfdc662478debe1c1f9e0b4fe1e23ebdf8f6040d6705d86ec7618d6535beb77270ff5e3ca408f11f1b2491f3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
228KB

MD5
81aac862477b5828b8a3f00b542ee386

SHA1
44e2a5261ea1666d6b0533b4677ee4cc303cd4ed

SHA256
fe86be92d621c51eed0fce65195b3eba2ee0afc7c19dfe4c7f21ea7b8d429a56

SHA512
033854a6a31bc183e4ae53337b1f9a9c598d978492ce0fc043e260aa87e59d54ec8f7e500169ed954b890b002cd89e633c84f806fe23debad77e3a80cab2c43c

Download Submit
memory/552-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download