98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80

General

Target

98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
Size

64KB
MD5

54206afc4f4ed0137dfe042126a14041
SHA1

5e17dbe71e1909bbad7a4c5e0ffb8a11d722a8e8
SHA256

98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80
SHA512

33225aa58168bf91850ed06215834deaa94d1e95f93795e8ef6fc1e1ae756ac3b4d4727479b0a44bc25fa860f319cd420324f04507c9db2051e861d46e318212
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8rhD:+nyiQSou

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1488-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1488-1956-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1488-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1488-1956-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\BlockSubmit.i64.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader_icd.json.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySharePoints.ico.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe

C:\Users\Admin\AppData\Local\Temp\98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe
"C:\Users\Admin\AppData\Local\Temp\98f9d3d10a8fc3fc892bb398618116ed94480e5c855aca8d3e29feafb2859c80.exe"
1⤵
- Drops file in Program Files directory
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
64KB

MD5
ddb1617fa9f5da7e86c3160ec971c792

SHA1
01ea095f664a93f9e1d04b63776228bf48f125a9

SHA256
fc63f214834c4899cb5d90771ce7bc6453eac84051ff1b4e45fc8da188fff8b8

SHA512
a0f4fafe649485db93ed80c21b84b9f5c1f681041b19f3b1098fd313c492268762d852b1d4873f4aeec53b702db109b68a16a54e66b559df07415e5d2f16dba6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
163KB

MD5
21601126952a8717c4d500c4c4c6ee4d

SHA1
d105bde478d988c0712e03c59204afb7e4653adc

SHA256
3bf532b2ac14075665bbb22be6b7ff625134e4960b3d0ef03f4e6ad0d5098cca

SHA512
8ca35dca758bff979f192af83f0c0fef92a421381540d2cce6c00c12f93f4b9c6de623b50d2a752c6bdd8f96ae6df3392d0e1fbc7b14ce509c048622229d1164

Download Submit
memory/1488-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1488-1956-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads