7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
Size

81KB
MD5

eb817201d77c3e9b1d8342688dd5fa63
SHA1

2304b9ca82cf20856ef351db2c42d55c59838f76
SHA256

7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5
SHA512

b2d64a4fcf067385a9c1de60d66d37d0036cd40dc8f3f44abe5be5cd57d7e4778fa84d9cd3d42105803bdfd089eae7b3a2ee2eceac697e8cca260933deed1c30
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDG9:fnyiQSoF

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4846) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1532-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0007000000023298-2.dat	UPX
behavioral2/files/0x0007000000022983-6.dat	UPX
behavioral2/memory/1532-1782-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1532-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000023298-2.dat	upx
behavioral2/files/0x0007000000022983-6.dat	upx
behavioral2/memory/1532-1782-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\mojo_core.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe

C:\Users\Admin\AppData\Local\Temp\7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe
"C:\Users\Admin\AppData\Local\Temp\7e09b9eb64c8877b4af4b2ee8d2727a8b657f6bc9a3582eb5829fbadf16060e5.exe"
1⤵
- Drops file in Program Files directory
PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
81KB

MD5
54667c70e0aec466155889ad0cb4bb29

SHA1
eb6167cc79aaf619e1e37f6d2a6c82689e31eff6

SHA256
4c637b6ef95e9109242d550b47e54b2c3e174fd19a1ffc3065df1a8a3e2678df

SHA512
f65762a112d662133b18a0c0fe813183ebed9f212f99edfb4f18c7a7fc3d4e0f0d7aa8695481ca68d2a23b6fd0a1c74dc8760a6e2a6718bdc86d1996b9dd3211

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
167397787ee30dd31a1c27bb182f2790

SHA1
dededbee4de3da0b335ed2432d5ec7c3f131f29a

SHA256
88d9074b763a7636c37c8ad5253ad26d57b91538f588d140698f4833a6bf4587

SHA512
63cf18defdc8c6d6d49a020144d38d539815381f2c94ca6b044e7d2b240609f0061f6ad4ce0bff640b41b6359c2413a24b2e274ee689d8cdfa960430a7688075

Download Submit
memory/1532-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1532-1782-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download