1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991

General

Target

1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
Size

40KB
MD5

6f8716ab63d33729682538510d37ec4c
SHA1

276a8ac246266998f30d8b51da00d1e5fe44e03b
SHA256

1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991
SHA512

6412cd812115d5b6ba153b7c99d65a12c07ff2521c6129484315e6f34cf5090cfa1f57a0c8e6b2cd67130ddae74a81de8a9bd113a9f3af605ce48e7438b8f743
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFa:CTWn1++PJHJXA/OsIZfzc3/Q8a

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2044-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.chm.tmp	UPX
behavioral2/memory/2044-1126-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2044-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.chm.tmp	upx
behavioral2/memory/2044-1126-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxbgt.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe

C:\Users\Admin\AppData\Local\Temp\1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe
"C:\Users\Admin\AppData\Local\Temp\1d5d0b76f1bd5bb7230f3711933dd907f62c1fe0c612b1e9e3139ca8b5330991.exe"
1⤵
- Drops file in Program Files directory
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
40KB

MD5
6499aa1e27c0c97ce32d894d7c048c90

SHA1
0b4b1902266e51dc11f1a0b38ce0224b0bd20dc4

SHA256
87acabd1c714f6d729745e59725a1d7bf20a93a2c99fb046d8add304407543d0

SHA512
c6d134f967c3fac699f4e9ab2f87af647f353db4a95852ec37df654117aa69eaf5afc0778a1d2dfe8b0467f05c6c96d6598250153208fb7e5c52f7180c08ebe1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
153KB

MD5
923acfebe05efc1ea466174b9bd505c6

SHA1
1d5e9ac6dd64a7bc4304ab98c415d0ae47e2b9d5

SHA256
0b4ec8750f66758c81432e802136b608482fbd9da2aaeb43129a038482664fb5

SHA512
d9066ba84222e07aea62c2c4c4687ce24f69efbd9154afc291cf75f58eef9eb5f31d20b6ca06769382b369e209668caf723fcfdbfd11e3d71059001c32d1aef8

Download Submit
memory/2044-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2044-1126-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads