192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
Size

53KB
MD5

658d3d0691c138533051d139ba21747d
SHA1

6b6bf31f2203ca3723d51f37355da46163ec816c
SHA256

192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6
SHA512

b08b22ffbaf8842c6061c2607f6498e3a1a698060dc26b9fe591cb4bf08430fd70bb9abfd9fa03451ec7f0fbecfffdc844b34c5b78fc0071168f8c31e44547e4
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFZj:67Zf/FAxTWY1++PJHJXA/OsIZL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5036) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x00090000000226f2-2.dat	UPX
behavioral2/files/0x00090000000233f4-6.dat	UPX
behavioral2/memory/3824-1848-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000226f2-2.dat	upx
behavioral2/files/0x00090000000233f4-6.dat	upx
behavioral2/memory/3824-1848-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe

C:\Users\Admin\AppData\Local\Temp\192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
"C:\Users\Admin\AppData\Local\Temp\192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe"
1⤵
- Drops file in Program Files directory
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
53KB

MD5
d2a65b6ed6a5b551f6e5d3cc74c03be3

SHA1
1e8be13c07806e35c164c5dea2083d94228a55b6

SHA256
92bc01af085bf81ae66681b85622e578788b60ac7ab00c81c088018034d8c54e

SHA512
c2b7850ed5db3b15bebb298db7a918207a51b68e3f7ed4081ad4d4a48762a06c098e0af71539dc5c9d927d68c1dcf6c094054e0e825f5034818db4c2c53ee6c0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
5ebeaa717ed343bb4d860c146b9898dd

SHA1
d81d7a1873b95c13d56805e1b4d53f7136ddc74f

SHA256
464a3b5dd099c89fac11b0a63f23dbab97a020eee51aceb664191e297c36e1d2

SHA512
f5b5fe93e4b29c2fa6644a04d91bd04947cec0dd697ec73e9c9d1e66773518132fa8fe7214e457a8ec56fc4243a21600a52f57ed23061a4197778879a795ad1b

Download Submit
memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3824-1848-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download