8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef

General

Target

8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
Size

80KB
MD5

359ff2287796ab7e5ebd1e79071d707f
SHA1

9d34f2e391e005c8f20b4c79ebb1da2b5ffccfd2
SHA256

8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef
SHA512

2050cac9a7f988f4898ff168f29bce3b8d7d909f18b8b510de1fe1bbc15ae2f74521f74e6f9a05d7f81e6d6f0544ce3afc0af184c5e0d00621d4c6cb544bdc4f
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJ0:+nyiQSoe

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5126) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/532-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/532-1926-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/532-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/532-1926-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe

description	ioc	process
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp	8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe

C:\Users\Admin\AppData\Local\Temp\8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe
"C:\Users\Admin\AppData\Local\Temp\8935815167afddb6f24cf83ea64de5f42c3210d4537102660ffd675de40a79ef.exe"
1⤵
- Drops file in Program Files directory
PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
80KB

MD5
b0174971458ac8fa45fb048569593b32

SHA1
e159f94edf60183f9272eb584d63698bb8902e25

SHA256
0abbdb7053fda8075844679378642ff3fb41482abeb3c52f51f8d221b2203105

SHA512
4ed4c61c0927f30462990d688b5ddab7a66578b2f1b1f61aef8ade9ff6fb117bc41367f5a383931b142b5987c12b68fc601e8b4648b344791d6e07611489357f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
179KB

MD5
98e055b378327dcd6094c1c5a45a9b19

SHA1
81343da382a45b563790c731bc2b3179ead32756

SHA256
5c6eaf11504b7fbd2a03daeb93b31eb95a947617388abe1298a87eac4bfed2bf

SHA512
faba48ab67467023ac02068b8b3d3a12ba6ac9eefbf587496ca30fe2deb0c4e95415f5fd1a8e39f306fc472cec8a393adb6ee96b5f48e054a47fd23a7c8a6cde

Download Submit
memory/532-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/532-1926-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads