e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026

General

Target

e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
Size

51KB
MD5

159c80f749a33cd22d66d34d71b1c473
SHA1

11005accd36c6fd2a9cfb0f979761bf5f22b9edd
SHA256

e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026
SHA512

f80a7666fc3f8967bd9075c575e275a6ce6f3db07d17b07f7201f1fe1c6630f132038978a377efe76d6809bba5b5b2a009e7a3155f401a44c1fd44663f2c3c6e
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8KTcTSbyEmOTcTSbyEm6:KQSodTcTSWEmOTcTSWEm6

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5239) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1488-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1488-1182-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1488-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1488-1182-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe

C:\Users\Admin\AppData\Local\Temp\e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe
"C:\Users\Admin\AppData\Local\Temp\e2844a55ccdbb2f66f04f6a560ef834f0fda2d8ac62fad517b3e544bc0607026.exe"
1⤵
- Drops file in Program Files directory
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
51KB

MD5
7b5ab8d8b8898e45ae72cc29223a500e

SHA1
6bf24daafb25fd796585f4d3f26a6c5abb3ee342

SHA256
1e3de5a23d0467e91a73067ec0b3ed5ecbbd326494da02e76e5650934b61704f

SHA512
718f889acaa01e2095bc9f8341f554e2d0bf6a6dacd41b37b5099c3f0b12a66aff779cae40c6869409bf4a0a3cfdf0f232e44f5d99dbdb5e2698a153b4d3f398

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
51da3baaf2ff616b3139a1acc83da683

SHA1
ca83bfa01af67397a03461f5a34f19e17445d61e

SHA256
ab1e696a6391aebfd93499150ce8c1bc9438797fb9b410475bffb87d316f7db6

SHA512
2feb05555acce9a742085e4aecb3445faa2b0e1d9a36f1fed7f428f169740f670f90656ebb7e1253865784209907789af0a5582e5d6fd1bfed647dc4fcf05e7c

Download Submit
memory/1488-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1488-1182-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads