e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
Size

43KB
MD5

5b9a3046f13e3f74f107be539eaebbcf
SHA1

944542a8eddcdde8f916fb83a4fc843908906f43
SHA256

e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc
SHA512

c4f3c6829c58e115f3b3d1bf0ec023beb2ded8bdca788065e6d611bbc733f6324fc2b7221e847937bd8e848889f6b685026ea4f77eca28ae31fa86afaa9b21e6
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFE:CTWn1++PJHJXA/OsIZfzc3/Q8E

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4838) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0007000000023308-2.dat	UPX
behavioral2/files/0x00080000000229db-6.dat	UPX
behavioral2/memory/3004-926-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0007000000023308-2.dat	upx
behavioral2/files/0x00080000000229db-6.dat	upx
behavioral2/memory/3004-926-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PEOPLEDATAHANDLER.DLL.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe

C:\Users\Admin\AppData\Local\Temp\e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe
"C:\Users\Admin\AppData\Local\Temp\e1865b2cc0e4329b25e390335de5459d39f7e89608a6c2c3d056462177d28fdc.exe"
1⤵
- Drops file in Program Files directory
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
43KB

MD5
46577db4274a5922095a5e3b86e6ef7f

SHA1
5a10870cec13a3b434fde591f093a03643c1aa6f

SHA256
860d677f6934cdfb4b465799dd0b7c23b50be85a5ed79ad5a4d696ff7537df1f

SHA512
a8e8f6d6c50f0ffd83a1f2b1ead0689ee1a240a6f889077d0740ee02eff660ef21e93c40f1432b76067064ee1e9df921301e3a8aea1105e86c9ffbac47f9fd9b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
9481a9c7dcaef05ad945bd0bf331cf22

SHA1
dca606486ab9bf8d70e10471003c756dc6f1a4f1

SHA256
fdfad1a34a24c2e1caf7d904128b32a0d36b41838307c46c644b52611b57f430

SHA512
d04ac9dd862b3929972b4de713cddddf115b2e97084840fd7ab32502cbb8757a18f326564a74e61f2d5fb5c8383443d6f4e7470737900b80a74f199ab7dcb2bd

Download Submit
memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3004-926-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download