01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
Size

42KB
MD5

a0ecb5f758334579201dd8f2f351a1ba
SHA1

22be90d8a16d64a743f81120b50c8840d83ff6ed
SHA256

01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1
SHA512

c97edd2a206e7a2ec6a1f571660d7226ff2c03c3b5a6962e3db0dd9be0435a3749f799e492cd6267062f16c2577561a2c69d9aafcdfaabdb62970d0989f0c5ad
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQD:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/83

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2244-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0008000000022f51-2.dat	UPX
behavioral2/files/0x0009000000022979-6.dat	UPX
behavioral2/memory/2244-1104-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2244-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-2.dat	upx
behavioral2/files/0x0009000000022979-6.dat	upx
behavioral2/memory/2244-1104-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEXBE.DLL.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHIC.TTF.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe

C:\Users\Admin\AppData\Local\Temp\01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe
"C:\Users\Admin\AppData\Local\Temp\01e961b6baaaf450dbe32e75cfc5b8ec920d381c3105ed416339c033393432a1.exe"
1⤵
- Drops file in Program Files directory
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
42KB

MD5
cd9d351a6125e06d65ed684bed8f1617

SHA1
94aa221b5f54ca80b84fa24a1c90a6084e338f8e

SHA256
eaeb32d57cc6590a4b4c53b9c13d8042cae63a0d7b95f3295eb09c1754758287

SHA512
294aa6d1a1dc84cd847f15360b8c333169c0f8258c391807e14a761ae697d242754d90ec53a18a337a7b861c154ba6650fbe416750813f56bbc60e9091c1538b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
3b33b5f6fb1fd92d5e6727599ecef84a

SHA1
1bab3f1303b5d77efcf1c7bf2afc8af7885ac94a

SHA256
53be4410d00aac15b99ad32f1a84be7a4873d6885369354cb650362ea1cfba21

SHA512
557795d3850abe79d49b344489d08a3d18488a2eece27b3a1ce7930d054c914d1aa96eec0048289f01cb3f024ecb96e78f435db2727642b9d3ec2e74830b4c30

Download Submit
memory/2244-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-1104-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download