065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807

General

Target

065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
Size

75KB
MD5

57aefd44bf091b58f6b5e66fdf016688
SHA1

761d00dbfd4d1b924a8fe558ab4e97ed38db0372
SHA256

065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807
SHA512

4e4b1e842030fc309b773de220a9acca662854179d6bcef5bfcfd9b222c99ab3ea92d0b137f9c5f7f202ce625906eddbb7d6dcb9155ed3993010deb59716ff66
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiWJQBJQt:+nyiQSoT

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1468-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1468-1900-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1468-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1468-1900-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe

C:\Users\Admin\AppData\Local\Temp\065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe
"C:\Users\Admin\AppData\Local\Temp\065127193e6629d719c1d21be4d98371b296d9d78b998a225434837b236c2807.exe"
1⤵
- Drops file in Program Files directory
PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
75KB

MD5
247f87735c3d5fda9377b47bc1483885

SHA1
3ed985ebbbc9bccba8ad938ccad226b7411e10c8

SHA256
ade1b8a3075dbcec2ec74c7d8f242adefff48f68543aade928ad7131141eff5e

SHA512
65d83be56c3dfbd4147b47c59cfe02b276a3ded2794ef37791c9704909fe3055ebd8310581357e751ae0320ecc3e9da5bd2fdbb9d8d46f89aa0c0179ae18e334

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
174KB

MD5
8313567dcc2074520631ecd09d4bbdd2

SHA1
2f037176cb3e583ab451fe82e4a5cc1f023a4e87

SHA256
de77bdde9279add2378f276e60142c64579fc7a444535927ef2e6e6c1a2c2372

SHA512
589b486e4d3aa88e7ce9a0827ac3efba4f508a5b0202ee632763acb02f55e23cd378d5435d7eba4ed0c31862faa8e584d9646c45d93f5639b1ee5b2c8d31c366

Download Submit
memory/1468-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1468-1900-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads