0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33

General

Target

0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
Size

204KB
MD5

804e9cd57c3e5957969a71f3c331e8fc
SHA1

7f3eb2888fbda7068e118063741f778c336616c6
SHA256

0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33
SHA512

b42b4c93ad6557ddb1e7fafa1e20a09bf1980a76e4dc9c29c3dd31ab2f61b84ffa15a71c697094355ad6abe1ab1a81a9d444813a6e09420142634d6e27e3948d
SSDEEP

3072:enaym3AIuZAIuYSMjoqtMHfhfJ6W2QZwKS7TH0WH0/:wHm3AIuZAIuDMVtM/L2ZKS7TH0WH0/

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1464-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1464-1588-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1464-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1464-1588-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe

C:\Users\Admin\AppData\Local\Temp\0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe
"C:\Users\Admin\AppData\Local\Temp\0a4f3efe929a98918d721f00e3324bebaed472113b64f8dfdf446e3af4ab7a33.exe"
1⤵
- Drops file in Program Files directory
PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
205KB

MD5
13720fb96d87fa96cafadbb1d11f6f40

SHA1
18d1752dbd3f61aa84a93cc7d9f23d6cac3b64c0

SHA256
41467b014974dabab248cb92ac03facd8488b062f54137bece78a7fac55d714b

SHA512
2c6c7b6b5fbd30a2d61a7996b76247db69f69f753544f5a28fcca12b7cf24cdb5b7dfa40f4963386db170d987de5f408dca4312c75e365e626a484914b2673dd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
303KB

MD5
2c0aac775a192e690ea8d52e65ac2344

SHA1
347c2cce85a95c8721d186e96736f4c9cac61982

SHA256
46a46cb83bcfd8a6a1ce08730890a49a6ae4ae4c44ac1debb28779ff43645700

SHA512
a7a09c15c37023522fb0c8fcacae02cf258068c11a90241cda027a6853343087e0de3971e3ac360d5c636391e0a10b7bbe1557e4d5a73b367774ca1e31cea33b

Download Submit
memory/1464-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1464-1588-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads