71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039

General

Target

71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
Size

70KB
MD5

24d72afe3a6e66698b0bf805b43a24b4
SHA1

1a03a2363c3f6274baf3b7e899b58e560eca1944
SHA256

71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039
SHA512

636ea194cd63e4a53ededf82c272291988707d414500302d62bcff4ebae01931dd89362a6759d423aae5e9de737dc00fa63435235acf36a7483e75f4839eda45
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsXaU5:fnyiQSohsUsB

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe

C:\Users\Admin\AppData\Local\Temp\71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
"C:\Users\Admin\AppData\Local\Temp\71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe"
1⤵
- Drops file in Program Files directory
PID:232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
70KB

MD5
e29bf75bcd045f0e19325a19a536d3b3

SHA1
33fff25eca0cffa7a506bfb68b65532aa66be940

SHA256
636b39c0d37dc2cef46e8be04fd2d3572383a63ac2bbdccf47bea3b0ae4e2280

SHA512
56deca895ebc9350da0ab053fa507b530584e07e1ae3b803733d749faef430c2baf6507bac6e77d30b2bc67213bf2164552a276342aebf954767e3efb099fc2d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
169KB

MD5
254070ddb6b993bb9455aee06bc8b183

SHA1
eb3bb0e89c6a632d9a8dc7fb16b1b0d5777ea76c

SHA256
7b3451294d6ac271adbc7429b7f92c01c673d730c88190dc74c83a1a5a30a627

SHA512
9ce76fb2fb20c0f496bfa83314cde2c6ee3f95672126f1ae408d5a1e6112166a1a8c7d45cf3cd5aaf4cc29f5efc8a6c5fc3b37d97be47be32e726005a369d92a

Download Submit
memory/232-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/232-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads