ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b

General

Target

ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
Size

122KB
MD5

0d2b3468041afbadcc6e24a647532600
SHA1

5a6a977f7e97749f74b39241e574300c0fb8c6ba
SHA256

ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b
SHA512

c76e80ebe44ada63b3b58bf36a29c1e6fb76a8d3d54ea88032e3cee75203a74b63020f6ed5562a0a3236dfdbee706b183c1da2def5aa62f3223bbc306f45b911
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCB:+nymCAIuZAIuYSMjoqtMHfhfk

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4726) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/736-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/736-1744-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/736-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/736-1744-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe

C:\Users\Admin\AppData\Local\Temp\ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe
"C:\Users\Admin\AppData\Local\Temp\ed2c00bbe014b94636a1040ca4bd527e9a7a2c0d9b06f927ca5dfb68fbcd2c7b.exe"
1⤵
- Drops file in Program Files directory
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
122KB

MD5
9690388a8f2e55c080fe5eeaf8e0df2a

SHA1
1a6eb31880aba2906ec44c15cbe184e4ed52f606

SHA256
d70043286aeca51bad799b50a3f503fc217db5183bdd97d390ed241c1875b168

SHA512
133ddc04119c0015ae3163ddd26951fb594c4b59355c4b9e954dbe682e0f3eb38982b6c479657f9b2feac8627d06ec0347cb6239b3c329c73651cd51afa3d843

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
221KB

MD5
5e4bf2d7f49d3fc815200abf49b1c103

SHA1
f710c718b85aebf11e7683ca25c5a872b4a0cbc1

SHA256
b23452e9d45f6ce34fffebd6346460f098321f86d362a609ec065b5fc4ace572

SHA512
9a301caf12b8615be1bcb9807d0f7dbe002ea9980c271c496a9325a37cadd5a1d8a56ae152efb15ff437bd53a2123c031c4328164580e5f7671534b4fd2bc238

Download Submit
memory/736-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/736-1744-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads