7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545

General

Target

7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
Size

63KB
MD5

4024724b719c7c623b100e21c0abf29b
SHA1

fb96bf14cf15427baf2891b69245b2b73e835660
SHA256

7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545
SHA512

b5c738c967291511046c3e356f4035964d9892f6170b2ccb973d0451f84b58a9d13ef2b696c6aa8863ac59ed484f1082d3aa99aa5c5364a278aa5c364f5a7fe9
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFufGWQMK:67Zf/FAxTWY1++PJHJXA/OsIZeGd

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2960-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.chm.tmp	UPX
behavioral2/memory/2960-1964-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2960-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.chm.tmp	upx
behavioral2/memory/2960-1964-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-environment-l1-1-0.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
File created	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp	7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe

C:\Users\Admin\AppData\Local\Temp\7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe
"C:\Users\Admin\AppData\Local\Temp\7395c905a3f9809218e3dcb109f958e03d98fd78cf3e58b76dd985d33df64545.exe"
1⤵
- Drops file in Program Files directory
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
1⤵
PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
63KB

MD5
f161c1d9928399441d815c70a91c13ad

SHA1
4e294b734cfe799d3c119746a09110a4c919e2ad

SHA256
6c7c7d4c8f39d8016082eea3922d9d8fb9a3f906df5d89ab0a7ddbb6653d0d1a

SHA512
1d316c6f54952f9527e5551d1cfc344cfdc1032d8532aa7a3140cc5b9b6a77c83ab6cb0a3b74d672687f6896e391cb165ef466378ca88e4199dd11ba4c199d50

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
175KB

MD5
6106104a02e55c970d274d0027d07161

SHA1
e7c8b8555cb5483c5c8d12dd251c61f146f39153

SHA256
62faa561735afdd61813707fb0055ebc81cf8bc030a2ceb6eefe7866af652d3f

SHA512
ac5850242716da00c8985df89f578b2f8b3d1d6d97b455343f24334ceeec55c2cc24dda3bd4271979a49aa8cab2db4827c85ce1e75739c197762f7221f47a138

Download Submit
memory/2960-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2960-1964-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads