4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
Size

129KB
MD5

718eb09a1c4ed55452049cce8c1dcf9c
SHA1

f191473b2c6ffc85f2f8637ab580c242341f218a
SHA256

4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae
SHA512

8259c6b5913422a70c1d96e8914fea37c2b583f7f38e42be243225126036223475e472316ac3ec8fc50797f28886acdc13032f6de9de2735a7f2f3ad6a4f8910
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSA:enaym3AIuZAIuYSMjoqtMHfhfK

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4798) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0006000000023308-2.dat	UPX
behavioral2/files/0x00080000000229db-6.dat	UPX
behavioral2/memory/1940-1744-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0006000000023308-2.dat	upx
behavioral2/files/0x00080000000229db-6.dat	upx
behavioral2/memory/1940-1744-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe

C:\Users\Admin\AppData\Local\Temp\4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe
"C:\Users\Admin\AppData\Local\Temp\4b54555da72de5e1564db850fa594632b17e7e87a11de8eb8d073ceb06837aae.exe"
1⤵
- Drops file in Program Files directory
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
129KB

MD5
cc53c8aed87d957b0e2572a53fa6b96f

SHA1
e19932cba0046330f72199c330742164bc48375c

SHA256
54c1ed9f0d34a9fc96889a280348cbe2220dc871abd96c155b234b9ea9fc9fb4

SHA512
8ce8914505751ee81527fd1d5ad0077edb1f9f3ddaaca91a19214c9f561cdf470dd5c267a78587d5e3ed8acf1f4d132eeb5d94c9839c2100d9040f7cad63f13f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
228KB

MD5
09c58b2a0defb88e41eabe62ab1c8899

SHA1
6aefcd1db85e4d2ff7e9ef65e3169bb74111c88b

SHA256
f7f885a72ed3d0a6fd8f7a4a349257dfecab453018f34aeeb9b9f4affefc69eb

SHA512
ddca716250c799b3487c56c3370275bcc2fcd34b612d9c29bc8d9ffeca2f3a04bdf30ecca8d1e970e02fcfa846759b762b7729abef7ea44cd08b139909f5d0da

Download Submit
memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1940-1744-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download