cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0

General

Target

cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
Size

74KB
MD5

8ee791a0754af6e6e6a5d584541f5834
SHA1

4d55686c02748acf1a80003bfc2af72a53faf753
SHA256

cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0
SHA512

2f28f2a9ec1ca3b723b217c34d913165a8a62b0144fe316c906f07e431151cbd427aa0c02d8e977e57b3c88fb16b23e241683a0ebcf6e72937b3b346e9232019
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJ9:fnyiQSoL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/4252-1828-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4252-1828-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARAIT.TTF.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe

C:\Users\Admin\AppData\Local\Temp\cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe
"C:\Users\Admin\AppData\Local\Temp\cafc8d7b68f9cc06277ce88ad0b802727659650393ca8ca6952dca0cd23d75d0.exe"
1⤵
- Drops file in Program Files directory
PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
75KB

MD5
7b6786fe4b2e04166bb583641c376b7b

SHA1
d8ec1a963767e83ad68e13c3d1eb2da522f6dc12

SHA256
4cdde7b8184ec8384defada3ee33bd460c62708cf1e92129e003d09cca400cdb

SHA512
d547389203527da8c8bb9be09c5743ee810b283bd2811d06f0e8d494312950b9cb5a0c575bd031bc767f87b1b09e4037ebecefc6e9c5c417be28c664aaa206b7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
173KB

MD5
f6b6c3eb1550ff1ecc388d8af7e4386c

SHA1
5b56c45156a78630401996a3acce3ec8f01656b3

SHA256
ec08080127fb4f9d1a6df7ca1932a97e43eb39149067142de16af6c14aa7f1c3

SHA512
c22df08e355f099c7c9963f935e903d3df7378e79271c1b70feb4a6ab443e38a3185c2891eece6f139c946def6bea9013777e2941208b6ff90bb9a4b1edcf27e

Download Submit
memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4252-1828-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads