b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99

General

Target

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
Size

99KB
MD5

8b3a85c82a3aa8d9d2ef9c4db37fc24b
SHA1

60cb67e914742e8c9f765f3004aeb07b97a91900
SHA256

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99
SHA512

ebff066c5ea6c5da4f586d824c7d491dd809ad2b5642c9adf942d3ee920515fa38590f8cc482c58c7de32799b9df7d0bffb558ccf5864ca6de99da37f02eaf04
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfA:hfAIuZAIuYSMjoqtMHfhfA

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4891) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/64-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/64-1010-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/64-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/64-1010-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe

C:\Users\Admin\AppData\Local\Temp\b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
"C:\Users\Admin\AppData\Local\Temp\b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe"
1⤵
- Drops file in Program Files directory
PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
100KB

MD5
a9c0fe963974b706573c79b0a2847ead

SHA1
3edfe314be7de79be8736962e79daf7957f5c7cf

SHA256
e393ef8133a949f299ea02acbdaba79771b63c93d30681fe331de18fa4ab968f

SHA512
2b0ad3f6aeee74733895a21ed765aa2563b7e1b1c797dec1db21b9768081b3cb7509ffcde2b7f2fce0b5408c9b708ac138e2071951072168b48851d2d6ac06c5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
198KB

MD5
f93c08d2bb979c90144dff13338a7f5e

SHA1
4d5a5ad4926f3d9b6b3cdd30a5257b6ec487e668

SHA256
ccab7b4a620833a9ecf280f7fbc5d92368e212891112156ff1fbbba03dec85b6

SHA512
bc31a1594ef9690ee7d9c1fd11d6969d61c3992dcbed3dca610cbdc6ba2787f1f2337d0190acdd310825bf47b55ef3266b33d86a7df8e31baa8e1de3d2c50ce3

Download Submit
memory/64-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/64-1010-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads