fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd

General

Target

fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
Size

97KB
MD5

2bc531a3f81217bd96860e8e54e89fe4
SHA1

adbee703bbde51289e81805b9c80cafba17f4743
SHA256

fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd
SHA512

35688a0a170979f5a2bc251d020dccd02be1157db19c7a4c1f91b44446c77169950e5dd78b29152f89ac04efdd5b49beeba731084b59250b454fe744fced99fc
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfa:hfAIuZAIuYSMjoqtMHfhfa

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3516-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.exe	UPX
behavioral2/memory/3516-868-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3516-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.exe	upx
behavioral2/memory/3516-868-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe

C:\Users\Admin\AppData\Local\Temp\fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe
"C:\Users\Admin\AppData\Local\Temp\fa8de58d621af97295e74441dd3467cb551773d24a49dcd0c9a069f5bb3e7cbd.exe"
1⤵
- Drops file in Program Files directory
PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
Filesize
97KB

MD5
0d6de8124243bf709ff6f93d14cb3b98

SHA1
dbd85ce3ade2fb83845b1841130d362847e4c705

SHA256
cbd84331a143dcbe512040ed3662a9574a23d31b62a951e69ee4baa36762a18b

SHA512
3684da19f998bcbc6ddb6ed4cd034c6da8f432ce16e27c02246cced85918a67e5da61224b38a893a6ba3a985c1d4e31bf20ec6af2b088846f38eb3c2eff6466d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe
Filesize
196KB

MD5
4d959a6d5574b55753f0d63b916ea5c5

SHA1
0ad22fa41e65e5a678fa1f06034c96c7ec4c62c6

SHA256
81b2f10b338f8f10162b27f42dcfc16633dee438da4c210ffca950ecae37775a

SHA512
f43b60028809748c43cf63557e30c2a913909c22ec041462ea7d84fbbcc8ac06748ed716fcc8be49df51cfcb2ca82632b2c61bc93a3baf95c2a34c42eaefae22

Download Submit
memory/3516-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3516-868-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads