9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db

General

Target

9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
Size

43KB
MD5

2cbc215a225a0aa2bb28c59e97245d21
SHA1

bec683ce978c57f38ed4430bcff9a1fd84066642
SHA256

9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db
SHA512

646ae3d6012eb54ec4c0dbccad8abb4ce96a6519c4abf3b762be6a5cb570024567a53b81ca54609b1c5711b65aedcde1a083df6554af2e213e47977512c6f369
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzg:CTWn1++PJHJXA/OsIZfzc3/Q8z2xlxr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5134) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/5012-1108-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/5012-1108-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe

C:\Users\Admin\AppData\Local\Temp\9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe
"C:\Users\Admin\AppData\Local\Temp\9ce52f2f72507f4e3776c1346ef2150cb743874795ed56d94ac3cd39473664db.exe"
1⤵
- Drops file in Program Files directory
PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
43KB

MD5
a6ad2ff6539aaf04eb4b0f58e1706c55

SHA1
5b43edc8dd80319079e6585a527e31c4db1c3971

SHA256
e8a8624c128e7c96fe0c24a43618aadaab8bad71e986962785dc97c608c07714

SHA512
b6d34936dc03bca3e8ccb44d6d7625ca58a957d79d6241ff0dea9cfa9515b73eec58594293672656b83040ecba84c24e7fbed2b3da12c9a35b8a4e9973f22b2e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
142KB

MD5
474a8819a3f57e720ec1245f0cea43c8

SHA1
decb49bbc3f6a2d9ef774f32e77dce0e34ff08c4

SHA256
63584204fd1c0e0ff921b920a80f201bec960299577154c884f7790d80ce2dcd

SHA512
ed11ebf4df9e2f3879a123ed2fbf686f137e24f122d55bc6b1e276d044a4ed3aa919110da4b4306ca3cdea72150ecda443ca39fc8adefeff0fb09884774026c6

Download Submit
memory/5012-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5012-1108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads