71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
Size

70KB
MD5

24d72afe3a6e66698b0bf805b43a24b4
SHA1

1a03a2363c3f6274baf3b7e899b58e560eca1944
SHA256

71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039
SHA512

636ea194cd63e4a53ededf82c272291988707d414500302d62bcff4ebae01931dd89362a6759d423aae5e9de737dc00fa63435235acf36a7483e75f4839eda45
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsXaU5:fnyiQSohsUsB

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x00070000000232a4-2.dat	UPX
behavioral2/files/0x0008000000022996-6.dat	UPX
behavioral2/memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00070000000232a4-2.dat	upx
behavioral2/files/0x0008000000022996-6.dat	upx
behavioral2/memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe

C:\Users\Admin\AppData\Local\Temp\71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
"C:\Users\Admin\AppData\Local\Temp\71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe"
1⤵
- Drops file in Program Files directory
PID:232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
70KB

MD5
e29bf75bcd045f0e19325a19a536d3b3

SHA1
33fff25eca0cffa7a506bfb68b65532aa66be940

SHA256
636b39c0d37dc2cef46e8be04fd2d3572383a63ac2bbdccf47bea3b0ae4e2280

SHA512
56deca895ebc9350da0ab053fa507b530584e07e1ae3b803733d749faef430c2baf6507bac6e77d30b2bc67213bf2164552a276342aebf954767e3efb099fc2d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
254070ddb6b993bb9455aee06bc8b183

SHA1
eb3bb0e89c6a632d9a8dc7fb16b1b0d5777ea76c

SHA256
7b3451294d6ac271adbc7429b7f92c01c673d730c88190dc74c83a1a5a30a627

SHA512
9ce76fb2fb20c0f496bfa83314cde2c6ee3f95672126f1ae408d5a1e6112166a1a8c7d45cf3cd5aaf4cc29f5efc8a6c5fc3b37d97be47be32e726005a369d92a

Download Submit
memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download