38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3

Analysis

max time kernel
149s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
Size

109KB
MD5

48134c43652e540ff3fdd904ca96aaa6
SHA1

021cab1a9935bd14cc6ee82a5fe63fcee19f5373
SHA256

38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3
SHA512

59730ada485cfa3d0a08140518e9fc4add6101ef509c4d9ce68f432c403f10d20e4a2314e3efd298b15e8043ee9c9aa748fbe486bd7dc7e56c91e90b4a446ea5
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfS/j:hfAIuZAIuYSMjoqtMHfhfqnj

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3812-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000600000002326f-2.dat	UPX
behavioral2/files/0x001d00000002292b-6.dat	UPX
behavioral2/memory/3812-1086-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3812-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000600000002326f-2.dat	upx
behavioral2/files/0x001d00000002292b-6.dat	upx
behavioral2/memory/3812-1086-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe

C:\Users\Admin\AppData\Local\Temp\38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe
"C:\Users\Admin\AppData\Local\Temp\38a837c629181a67436c7f40535860255bca3e2dbd1f95fdc60de746d392a0b3.exe"
1⤵
- Drops file in Program Files directory
PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
110KB

MD5
cf15ff9befb6b013fad625135784b981

SHA1
521d0ac02dcd02078b2798c41fd0a8cb0cb39b58

SHA256
3bb816218618d1c043a43e3b1b22a0b57b56578cff8356a0869d01eb562c5606

SHA512
36e384c5a59bd8929cba734494d2cbe02efdab467bec55e19961e2ea03515ff37cc567d74f82a125f310b0adfcfa73aa8094a9370c3e928b443984a7cd212180

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
208KB

MD5
8c5f50bae81b871119688488155a55ac

SHA1
aa1e67e13c855d05c9b58ee086c775c98dcd677e

SHA256
02adf071faf4819a0e5c1e0223281a9eb154693da2175815ea9b011cde29c1cc

SHA512
fdffb2ddc8161f03c1249331eb5e8673e065e845e76b7b84213a784cf93184a49b3a33e3423c64dbe18b82a7e15114174f4a3e23688ee6ab0492995192fc241a

Download Submit
memory/3812-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3812-1086-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download