4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7

General

Target

4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
Size

73KB
MD5

5b409b566fe31b289dbae2a81e6442cf
SHA1

7e02fd7302d659b6be7dc3a43db580d935d2cec5
SHA256

4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7
SHA512

8ce75415b0fbebddc6a08a27003f847233e898fc84e6f265e5c064fd61177f96b5d1ef8919508b26961f9bced490ff5f6b3f4e69cc088830c1b63167b871095f
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/QbUkNdNI:+nyiQSobUkz6

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5014) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/4252-1798-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4252-1798-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\JoinPublish.vbs.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe

C:\Users\Admin\AppData\Local\Temp\4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe
"C:\Users\Admin\AppData\Local\Temp\4a1f08041ea213d211d22ee3b4c380886a221ce394d59f2845037b098e2271a7.exe"
1⤵
- Drops file in Program Files directory
PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
73KB

MD5
6d944c043b0c3d7e42ebd9839652ea1b

SHA1
7544d5a7cac12e331d621430d3ed78e5785584df

SHA256
0cd222c3c2f6f77de10c3e11f94868874a38b056cfa2f4518c39753382e075f0

SHA512
d2ff6cd10e0c63bdd4c301d84fe63c92e236bfb4eae2c9023990c03e60d5a4bd0594d3bf9e635953c2202099131c6a3f13199c9f4028150bf79677af7eed1ddc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
f6218a465252699ab433bdefb4560fd7

SHA1
ba81a9f45e3bd9d12b8b7be97f8d145b3bac69c8

SHA256
49fb702994b603e6e6f3dd4a22d6435e143378481f5e3823173c381fce1dc7b8

SHA512
8710ffbfb865ffab978721220ae44539665430ad6215c13fc13e2b9d02a87d50d23f9a4a3137347bea399c7b7d79ed6b941ff8028f9c1b1fb5735a77f621cc27

Download Submit
memory/4252-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4252-1798-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads