ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f

General

Target

ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
Size

62KB
MD5

135651f92099ee916426bbe64c409965
SHA1

697b452e0b2c0e4f54fc70f1f6f6453d8f69701b
SHA256

ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f
SHA512

bdc3cf148f71fabc00304ffab004c9427967e130073412bc284bf246fc97d3ce4b96c2790f3dc15b83a05e813538c1653cfff3b7e51bb8a74daaa7869100842e
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8A7:+nyiQSot7

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3436-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.exe	UPX
behavioral2/memory/3436-1886-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3436-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.exe	upx
behavioral2/memory/3436-1886-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe

C:\Users\Admin\AppData\Local\Temp\ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe
"C:\Users\Admin\AppData\Local\Temp\ab0ea4b1c2d3e5d710f98a3c4890a1de9aed0327d2ce23068236bfe5d06f507f.exe"
1⤵
- Drops file in Program Files directory
PID:3436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
62KB

MD5
904be7971dc6c7e1db6226269c3c9c91

SHA1
0d814ef2442ca71014ffe23078e0d0619c28d728

SHA256
d3dea6b74d06509399b61bf4fc06a245e469bb6c3b1a5237aa23057807f44a8f

SHA512
6a619fb5ba457c6bbcc06f427123514c5bf9f856fa6ff2d5f8c82669c38066c976bb060409ac5da9d4e1911141e4de9e2c7e488c2d7893b8abec2ddab663ff2a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe
Filesize
161KB

MD5
c693c5713784d53110fc74188bfe3e00

SHA1
3d34c87c56f2d9d3f3406d8e13a495d255199423

SHA256
2e408c69b2b9daf125ca7867b147dce385ba93dd9e3cef2ccd2b0a1310e665f6

SHA512
5ff8eb2d911d6dc930e1a65cc069b2fc0cf1515173cc28e4a4a11955aa3db6a091c6a9f2d6d036c2d6bfd0b22c78b17cb563c7608d30ee272e122c22b6b5b672

Download Submit
memory/3436-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3436-1886-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads