28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1

General

Target

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
Size

57KB
MD5

73cb66c0a8327950f74f74c97f5ee355
SHA1

78430083b1e28dc8075a011dc907bb24cef43e41
SHA256

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1
SHA512

7a0d11ae52435440c5ee7bd344e528d7cb8a23a87c120b9187b8a14209595fde54017d6b9f39eddeb4fbc72c4b00b847fa0ee452e8df385878801fb4b86d6199
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiAyI8yIs:KQSoLSs

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/940-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/940-1122-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/940-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/940-1122-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe

C:\Users\Admin\AppData\Local\Temp\28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
"C:\Users\Admin\AppData\Local\Temp\28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe"
1⤵
- Drops file in Program Files directory
PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
57KB

MD5
0ba2397be5a167636b9e3a512d9f0262

SHA1
fda0999bbf23909f78e6319152622887de4be0ef

SHA256
1dba1c2392e85ac004056709e043a8578aa213c832fb4cf9a992f750a69397ae

SHA512
00ecb16c0fe02b7030e24d758fc785bfaa098e6a0d99d753e29ac331ca120d8b9764878c844e238c3c6b274e26a7b508ed28da29e5a27090a68a5c84c2c32d6f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
156KB

MD5
02e7128043a8a069cb757c0e21134fb5

SHA1
5e7c64a2698eb1dfd169ca6cacc962ccdaa2212c

SHA256
0f7bbaebc356364d817fe0fe9e3c491b771839ad1f5dd2eb2d8ef99589264e26

SHA512
8525468c642e8763b2400dba1315d7eafffd9568b86730ec700be2c550f552f4a11b81deb0f468b3f7eebe43187c5ffc70cd02c3a45d8c0b38400f11af0f1af4

Download Submit
memory/940-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/940-1122-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads