41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202

General

Target

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
Size

170KB
MD5

7501869e973c7c25db1a4ede40c52bc2
SHA1

4c5dd39589da0b6b81e8904fc8062d1423cfad07
SHA256

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202
SHA512

f14dceba9b34dcbcf7080c72dd8d58c7fcb40de6e3611cfb14f354bda82edab59fe8f29f971344b2e374a13a02098bbc10ba9bba42d818fc728875d095a19db0
SSDEEP

3072:+nyiQSo17UYsC+hALfUqI0qEiDW6VcQgKX58r7:JiQSo17UYsC+iLfUY8DtVcaX56

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4685) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1676-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1676-1618-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1676-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1676-1618-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe

C:\Users\Admin\AppData\Local\Temp\41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
"C:\Users\Admin\AppData\Local\Temp\41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe"
1⤵
- Drops file in Program Files directory
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
Filesize
170KB

MD5
df8f7edd2cf4a984be5bf68216c211b1

SHA1
85bfb4b9f29436a26249a82a7d4aa82ca1c6ca3c

SHA256
cd480d4fca30e9806d61ea59b225b4728024dab97992559cfad6d977a4423d75

SHA512
d257700356bff393c9fc2c281bdd480d3c57a7c30eedd9e0fc3184057b3bd71b16c2118a4c9eaf00a4bfb83ed46dd7e38b2b0476b6c3f334c2c4a16a3cdeed14

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
269KB

MD5
128725f16f57255dc9f54358f0ad1973

SHA1
98b8483881943c06ea98e20617b5185bea203550

SHA256
bc61a34b33d1a0084caeda13948735ac98c573fbd412e71386be9d884b27895e

SHA512
cdfc462cf7fc4e17f4dae24e47c506d77a1f6b482089676fd209bde48a0df1af6e8cf89035190d91b0f6248bf2dd704ffcde405f856b91b66807c21c4e943a41

Download Submit
memory/1676-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1676-1618-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads