adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1

General

Target

adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
Size

47KB
MD5

7ac3bf90a567e854ddc613952630c329
SHA1

1a2488349d22272ae0170be1c6489e0ef2aa908d
SHA256

adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1
SHA512

75597fc34c8102693fef0ca18bf2b52eb359b292de89030dcfd1fee36d739c2bcf326c7c129c47b737f37881acc98e42d9cfec4c3345b9c5b139024905bd1762
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFan:CTWn1++PJHJXA/OsIZfzc3/Q8asUs18t

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/2688-1128-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/2688-1128-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_wer.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe

C:\Users\Admin\AppData\Local\Temp\adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe
"C:\Users\Admin\AppData\Local\Temp\adff37181edf470e9c2264c36ba4ac06d93637b5ee3e828334f15d313da70ab1.exe"
1⤵
- Drops file in Program Files directory
PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
Filesize
47KB

MD5
1326eb10a749ead6478b7d3105824fa7

SHA1
f87d975ec65a2d9088bc4b99569f67d80e776f70

SHA256
e130eec10372d9a951090a1597202f0e070a5f160c86ae2553f887c3356c100f

SHA512
59a3613d9e8d5462e25b8b310143964e9e5aa05687f825300baf9000fd829e45f5f8510c9e6953edef3eec8e46f011bd2c6cac88b2b667e2ccea78b33143b370

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
146KB

MD5
9b39318381457c437e18d73a6d310d42

SHA1
114b848c02671c7488beba0479b18d9cfb3193df

SHA256
9fa9fa4d9abe32fbe6cff28f51cf5e289708897a475f5c6d53fa72a6771ae551

SHA512
9f0f134853a0bcef445040e66d8f4696c3996e10fa4f9fa318f767b7c5d693cf3ff0b912895db2b0daa558f7602d597f5d05007e1ce2b3ed864954e35a5a8ffe

Download Submit
memory/2688-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2688-1128-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads