453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
Size

1.2MB
MD5

6c5dc914873107c8cb9282c6624053a1
SHA1

75978d2882828a167c49a350e0dbbc836e5498b1
SHA256

453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059
SHA512

582f955adfaae570974f0464fc73677fb5107507ff12b78323c27f22bcf53dc23f97e942887ac410e6f2ec52decacb2243ec8731d966c1a5befbdd55f11cac03
SSDEEP

12288:KQtyZGtKgZGtK/CAIuZAIuezr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bH:KItpzr0uRd7AnYszmn0E9UYy29H5+jb0

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2020) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x00090000000233ce-2.dat	UPX
behavioral2/files/0x000800000002295a-6.dat	UPX
behavioral2/memory/4772-394-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233ce-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/4772-394-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe

C:\Users\Admin\AppData\Local\Temp\453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe
"C:\Users\Admin\AppData\Local\Temp\453423f00856b7bb0037fca5ec59554ff0e87936223161d78ef72d5d07592059.exe"
1⤵
- Drops file in Program Files directory
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
1.2MB

MD5
bf8e2533a0c81e977f610686621e0e88

SHA1
5fff300da5216dc26e69c84a96611d3ec9847ed3

SHA256
ddccad04d76e0970a3b4368a7eaef54b43ecb9cf41966792f752714ac77f05d9

SHA512
130a62a70c90ec01faf82690690ba85493e83de5fb869cf7e2043ce8249abbb877cbdc151bdbceed8cd21335bd3ed8070260f243b27f5043dadd1beb6e26b03d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
1.3MB

MD5
103c12f9ba116d4761c0cee21648a2db

SHA1
617a9b06592e6c231f2d786b35af53cfd9b42126

SHA256
34ad19eeb15e900657ba601821cac4b303873e6ff1fae33b23718a7f45170c83

SHA512
ff0bd68e2b4a23f5f5442e4f59915d404849a090957ce3bb3caf1b596c1e1bbbf92a302d7dcaa830bbbe23a77bae03876f1425a61ae5f6c505531bba3c2fd5af

Download Submit
memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4772-394-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download