56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0

General

Target

56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
Size

56KB
MD5

0c8fce692678e5d357cc8cec80d906a3
SHA1

617f7e38c69baebaa21accf6e076eab5664d9e10
SHA256

56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0
SHA512

1da35ac0c39b73638bcdac44ab4cc84696c364f80577bd0362d599cfd957762011f203d6a1592c3ffb494ed6cf978335675269ec5f97cb16504bd6cac90421cc
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFufG7:67Zf/FAxTWY1++PJHJXA/OsIZh

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3032-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/3032-1780-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3032-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3032-1780-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_elf.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe

C:\Users\Admin\AppData\Local\Temp\56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe
"C:\Users\Admin\AppData\Local\Temp\56b8d7edb6e8514baf119dddeb24ae77538877403d0a080835d569c3e243a7a0.exe"
1⤵
- Drops file in Program Files directory
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
57KB

MD5
2f75c0a03280b7cc851bd6860021d405

SHA1
4459c77b70203a0b81dd3c90dc8a05aab2d478a5

SHA256
63368201f5e01002cc92515ff7c7a9bedf117ade31a482a1031626292ed26ac7

SHA512
9680c9bcb0295dbb076677440d19a76c2e35d7ff5a5a1a57fee9fe52ab592815351273d7f88e9402cd014974bdd83b0a9cbf3e5b158fccb779ad8c479bda76de

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
e08aa70580b9c3db3f0c97d142c4dbff

SHA1
07c07fe8baffeb1895a8510437ef10d7dd876b9e

SHA256
a7151813675ecc9c89fe79481ad56e691bd447b4d4e29b10510a553dfea00db9

SHA512
65fc33418e714d0c8c871ca84126438b6e7db2ad016b215f4527676e9a025041356ba9ea956e693cbc9542922dcba70e7c18f3bc34aa2db071cb829fb2806d84

Download Submit
memory/3032-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3032-1780-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads