0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a

General

Target

0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
Size

96KB
MD5

492a0b9f53bf0a98fb0983bfd16f2267
SHA1

5cbe4257948788f3e1354df96e06be246fa52d0a
SHA256

0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a
SHA512

c537aa78a6285346eee46fa4025360c11872755cdd40ee4a80852d76a99fecef27225b66f27b4b482938aad93ca9dadd85cea93daa6eb3843fcecd2b3f667487
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdS1:enaym3AIuZAIuYSMjoqtM1

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1568-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1568-1776-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1568-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1568-1776-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe

C:\Users\Admin\AppData\Local\Temp\0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe
"C:\Users\Admin\AppData\Local\Temp\0eb44cde84ca20af2a41111f988361dc326c29d1227723d27593f517b4221a0a.exe"
1⤵
- Drops file in Program Files directory
PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
96KB

MD5
785775dd1b8d351da15e0adfc7ff8ca3

SHA1
5adaf71f749e5effbe5b7088f100d507f05e17cd

SHA256
668460edda8948806cda1f2c81e46093ba6c8ddd36c6c9cd6ff371ce43e70e5e

SHA512
bc0677182c3b3cf47cb380cc247f09e2151201a6316290016ce9d20d929a05c411e48ce6c020a7becd9a61ef2d193e1ef2daa2d60ea4a2ea8ca543fae6e13644

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
195KB

MD5
f79eb29a49fb74016b1a7fdbbe2755d3

SHA1
907178479881805950968931cac5098392da0e45

SHA256
ac647a483934e8fba2bf6def62167d2d4536f298c964bf8b481d3ff1618666bb

SHA512
648f28fdcadee28602324f2c047cb6aa2a75a9253641b02ed1adcf2d2f41a49c2d2de812b2d84f9d31dd5bc03e05efcf01cc1e09b333966b3dfa403d1b3b5744

Download Submit
memory/1568-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1568-1776-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads