450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944

General

Target

450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
Size

149KB
MD5

0e2235b576253d56dab6bb43ac954e31
SHA1

ac44c5b3c65a9fdbb9aaec3f653401278818d1a5
SHA256

450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944
SHA512

a57b0241a3db39024021c7ae8cf82d857aa5a0ddce95a98057aec2935a36a815a13e6db193357ac750081a529e69a174be77003dbb286f1254fc779a1b7da865
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8s316u0MXo7Rwcz6G7wb/G0CIvXZ9yhHe:+nyiQSobuBhe6MiIqWLsUu3ih

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4711) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3080-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/3080-1680-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3080-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3080-1680-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe

C:\Users\Admin\AppData\Local\Temp\450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe
"C:\Users\Admin\AppData\Local\Temp\450db42ec387724b3979f81561727dff5b68ef9c9cfd0a50e38197474c1e2944.exe"
1⤵
- Drops file in Program Files directory
PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
150KB

MD5
011fda18e68d89b763d847f17bbfb277

SHA1
88c3bb989c5eede1238b58e54b6d3d36d7b00943

SHA256
a40cd23e43c478831f22feefd9b7d829bdf8a353cf743a23bae80f8ccade25c9

SHA512
15abf28a70592ee7f41e0c56cbfc4a3de4edaad8df814ce85cc4ef2c25297a2b830a48a7f0e1760c8a666f9db72693d550dc46d47111fe23baa2a552302f0cef

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
248KB

MD5
d351af8d60a1490eb7e63526241e023e

SHA1
5219530cfae91da43dc137a111046a0c27b85f1f

SHA256
e2c06fbd2e20060c2d2c6650f61c6c38e36e97fd5e8a0be8786142825449d893

SHA512
8ad9c97e9d55dc6000fe86945c2f29f77354ddf371847a4d6bd49b8ad073781f60d21db51b258604c0fafc38e1ddac2c458d7bfcc34942ebd951f7960abc7921

Download Submit
memory/3080-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3080-1680-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads