099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1

Analysis

max time kernel
150s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
Size

45KB
MD5

f98a261cfca6f109066daa5626a39a0e
SHA1

337a63bd15ecf686a8f20d38ec741c5c12f1def0
SHA256

099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1
SHA512

9fff428a38708224c4e92a8cb9abe21f449353cfabeecf0294dc69d35c75b92dbae9b9bc08c4a7206a1c990e40e2272cb37eeb35eebfd2647b531c5e89235492
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIO:CTWn1++PJHJXA/OsIZfzc3/Q8PxF

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/116-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0006000000023305-2.dat	UPX
behavioral2/files/0x00080000000229db-6.dat	UPX
behavioral2/memory/116-1146-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0006000000023305-2.dat	upx
behavioral2/files/0x00080000000229db-6.dat	upx
behavioral2/memory/116-1146-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\CloseInstall.css.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe

C:\Users\Admin\AppData\Local\Temp\099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
"C:\Users\Admin\AppData\Local\Temp\099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe"
1⤵
- Drops file in Program Files directory
PID:116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
45KB

MD5
3c9f4c48343fe064bfe53bcf0a66720c

SHA1
ca9911353d6dd559f2cb64252b1799899449cb71

SHA256
b4998e8e01d0de8b1dee7a3ac20fc814fc26f7d6dd1be26ef8fc9e42cebaa7c5

SHA512
35f9497448950fce916efdc79a35eff34e7c76feece13d1ec4d9c6940e42ceb00d89fe00594c02022fe1677d25c0ffcf2e85c3c94415f9bf418ac6dfbe79f66d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
c450cb05a9e257ab148752119c5047dc

SHA1
bae5b7c79ab00f7dc0c2e4b1b64c875a84f3958a

SHA256
4910c06d6474ce78c029f9f7620ff270bf031a910ed026cf70c30525a742614a

SHA512
780f4afd415a34dd4e5f0d8677a22647a59a02487b659106f71008c0c094810e1ff2622d76ced5f9e2e3ffd9a98fd7803d633ab415b4f0a4674781bdb0ddab20

Download Submit
memory/116-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/116-1146-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download