14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2

General

Target

14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
Size

210KB
MD5

3f813b51c26d1a3af8b6362de15e4c96
SHA1

91f229391b0e4e6e08cea709485d1ad449fedc5a
SHA256

14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2
SHA512

a9e3963b0cc1385bf9e07b320881f5e7139a908926f8ffdc731fbce23026a6f8383ef7644ac10d8f74151c6fd6867694caed93a9a523f4b1be47bf7e376ef28d
SSDEEP

3072:enaym3AIuZAIuYSMjoqtMHfhfA6W2QZwKS7T:wHm3AIuZAIuDMVtM/y2ZKS7T

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/2480-1632-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/2480-1632-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe

C:\Users\Admin\AppData\Local\Temp\14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe
"C:\Users\Admin\AppData\Local\Temp\14bfca54cf97bbd0a043e9b4c4441a194bd1fa1d711bd2639a01a74d3c1cf1d2.exe"
1⤵
- Drops file in Program Files directory
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
Filesize
210KB

MD5
b5621ab4323501033f3cceb84a8c9255

SHA1
145d5a21c668991a2c65bace7d2bebaf4f498860

SHA256
ffc0c3e66696da34e6c4c691655cc9910c6b4a9b497809f06b06423fc877aadd

SHA512
733950f633a56e39cd0e99f13d74d40dbc6c1479b9548b766edcd003efefb28c4faab2491b86108f2d7b149de9b25921876e3a0bcfd3bdfa5e411ab10c7984e1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
309KB

MD5
78ebe4c21eb41155128f0477d068ecbe

SHA1
c246b360c2c368cb2903b0f390a01a3c02ca12fc

SHA256
065626a05ce1ea758a689044523dbf7fdd919cd41c8b4495f731757ff68cb79f

SHA512
0e3d20e104a3d18d283728035ae5b29d891f7158909a79dd24e166a8d372e093dab9a8c64715e21f1e3acc07ca8da6b3700a255708467168ae00aca67fa815a8

Download Submit
memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2480-1632-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads