419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
Size

125KB
MD5

24a63745bca866462922fcca0d52c194
SHA1

8a00d3582eaa040396082c4a2bf8b9aefeed73cf
SHA256

419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e
SHA512

a5b463d17edc7b73dc42fe3cb973fbe8b05c2d455756e0be8b830d656103d8892c1ee0f5dbf79aa3091ad78be133159cd695df0b74732dc03e8059adad8791b2
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC0:+nymCAIuZAIuYSMjoqtMHfhfJ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4092-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0007000000023305-2.dat	UPX
behavioral2/files/0x00080000000229db-6.dat	UPX
behavioral2/memory/4092-1620-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000023305-2.dat	upx
behavioral2/files/0x00080000000229db-6.dat	upx
behavioral2/memory/4092-1620-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe

C:\Users\Admin\AppData\Local\Temp\419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe
"C:\Users\Admin\AppData\Local\Temp\419739868bbf8b4c3314497daeb0c9ba8167c06497f2181fbed16c76e0b5011e.exe"
1⤵
- Drops file in Program Files directory
PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
125KB

MD5
7237e17ed05da33232038af365c6fb68

SHA1
414ebe94c776d35c700f44224a75f7229b78c979

SHA256
7aaef2d890aad858ed31d43f8c9d4a7f20d94856bc19137415dd3b7f42bfb1d4

SHA512
e71d4d6ad16f0d389616042766992d41234937b4ab883fb4d88d60c251a289b7349a05515db1b02a17ad576d6c82f3460687332a60cbdf0518038dca92bd22f9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
224KB

MD5
6f0b92a81b82e8224f30d5076800e087

SHA1
805ce00b8c1bb5e08fdd26f9b3f62921fb70e3e7

SHA256
7647fad282293d57dcea30ea9c93b899c4bc9f3cc68d2189a76eab5fc5710c21

SHA512
181ec81d5855bea024a3c22d581439dfaa84f73a21bad21f6a4227d970756b39c590f945315da34def1a557e181e5186108e8dd5864f6d412ec4901e96c194eb

Download Submit
memory/4092-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4092-1620-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download