96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff

General

Target

96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
Size

72KB
MD5

8787ed5c1130b46aa3fa85d6019ea103
SHA1

004a83580018b8fa7ffd124b793b46f327e4b283
SHA256

96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff
SHA512

ebdff8805a3889c1ce0ce4dc5b85c7e14471cd1cf92b1807fbeaeef46c4dcf24ffdb58bc275146ad8ffcaee956379ff61a30b057fe895112c9ad50e83db34229
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/QbUkNdNe:+nyiQSobUkzc

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/4544-1950-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4544-1950-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe

C:\Users\Admin\AppData\Local\Temp\96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe
"C:\Users\Admin\AppData\Local\Temp\96a828040f54253d549fe5ec616d71ac2568d7c15133104afdb80adc460099ff.exe"
1⤵
- Drops file in Program Files directory
PID:4544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
72KB

MD5
a1d685431a57b22b8228317a1080cce7

SHA1
04a9d73e7563c60e681e629851e4bbedf789531e

SHA256
61cbae6f6bf8a639ef5ecab8f029a1ea5f33c8c3623459a1992c338d3a2409f7

SHA512
6857a5222f59d61a265ad516c1828c3168ebc0ff1324ad1cdcf7bcf7e0a25e1e1540420561e175e7db69db349e57ebe893205f072b4bbf85ade8214f0bc6a8ed

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
171KB

MD5
346a1615e941203a1e4150f0eda461e1

SHA1
097b749b1dd4fa742d4b6f7f60ae8f48ac7e27c4

SHA256
a23421b6c5a10d65e4a8314a5313e194bb8872bdf33ea4c3f616ea0a33c5cb34

SHA512
7a03dac0dd8fe7986f4bf831dfd455043260b1277eaf1a139d9f9723d2744c61cbb390349ea7189c935b6e7f81ce8326c360a0ddea3244a0613a7d6782d51723

Download Submit
memory/4544-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4544-1950-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads