a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7

General

Target

a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
Size

47KB
MD5

81296a6f4ceb041547f47c241b4613d1
SHA1

2b56b0463a65418bb024eb6a0427fff5a40e404e
SHA256

a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7
SHA512

76612108d5dd2205a01573b84551bc1f6dcd53480bdb5885d0892ad6c8e0bf9c33dda4b57b0521a174f7df14c7798c24cdf93a870b2a079e41a62ef385f68466
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFau:CTWn1++PJHJXA/OsIZfzc3/Q8asUs180

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5036) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/828-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/828-1090-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/828-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/828-1090-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe

C:\Users\Admin\AppData\Local\Temp\a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe
"C:\Users\Admin\AppData\Local\Temp\a36e4e0954a13647fb826df37c7a9eec51a20dccfd9adadabf6cdc589a5e27e7.exe"
1⤵
- Drops file in Program Files directory
PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
Filesize
47KB

MD5
d4e026a5b7561e57168324b078c3c070

SHA1
4c619d5f613420e908ceee95ef197802d75e9989

SHA256
4f6f0f5a57bfb851d87b74a2150f3a5c90fe41c8ba7fea28a55405322e8f55c6

SHA512
0108e865ca19e1d95150de6f7c60686e8ac389f51b7082934fda98f4f32baa7de502bd42282fa386ba8bf7545bfd01305a2cc219f8838f2c8b4dd1b620499ac9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
146KB

MD5
37b625f20f1a11831bb1b57a7d3eaa97

SHA1
6cc38ced4a5b0257c3c609d6017f645386e72089

SHA256
f533b0811113839fd6380144888657bcec19131ba1e57e8c728cbfd628f49ae0

SHA512
def52f8fc2dbd19d46da87941bbd579a5587411be1309e38aca57f18abb4f3caee68b8f7a52d3655d0055a4bbe099cbe30187b844734243975dae34e574dc163

Download Submit
memory/828-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/828-1090-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads