dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b

General

Target

dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
Size

74KB
MD5

2ac46e6596a14251d9a8d568b69212d8
SHA1

65cb206849d647e3c4a7736d2bba825fd66961e1
SHA256

dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b
SHA512

46bcafdc89dfc06756773719f185d74e0216992a3d4e872dd5c40501c73439430e7b362242950926ab1278b895da1bececb16a4261f524d56b3d13f75c883173
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiT:+nyiQSoC

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4816) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3600-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/3600-1762-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3600-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3600-1762-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe

C:\Users\Admin\AppData\Local\Temp\dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe
"C:\Users\Admin\AppData\Local\Temp\dd99b3b7d5407919be8719efdde7243a77e9db3a8c99bbf0d96a8b61c0c8f18b.exe"
1⤵
- Drops file in Program Files directory
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
Filesize
75KB

MD5
16f730621502ed5e0f4042f74ad15f84

SHA1
5978895f8c9fca7bcfd84f97631330a1ad911459

SHA256
207d148fadaa01bd991c4e17d3407cef29ee0429b793b75129947cfad87427fe

SHA512
9a29e3fdfa148052ecd14915dbe7e2ef453fdce559e5cd5df8eab84b0f7aa3d20b596b7be3a5a937b27f7af5ea34d27d842b0e571a62c2d245e5a084d9217546

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
174KB

MD5
1ac3d063f6361178ae803041ea363f2f

SHA1
d061be03962aef2ee3fc225a3b9f13d44e33c02e

SHA256
e8cd1e2ea1e6f490aa676e867ff4560811b7b46d31e4c3d69314da85b6f35b30

SHA512
91e887a8795e12ff377f29b08020f4290a654e78d59768fb9f38dd629aca43170961cbdab68abc03658edcdce19507773cfcc6f055b514f5c9809af323097fa2

Download Submit
memory/3600-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3600-1762-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads