cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
Size

50KB
MD5

479dbf6afa8e08f8c1361693c1c7836a
SHA1

c4607cbaffba2aa78c44ceedb1dfbf2618e9fd8a
SHA256

cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51
SHA512

ea9f39494316ff9ee289c0f9e0cc6be9d10354efbb570460ef536e07edf13ba7b862254885955407468973dd76cf574e604acb77c0c28489744b97c925c08beb
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUs6iYid:KQSohsUs6iYid

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5034) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000800000002343b-2.dat	UPX
behavioral2/files/0x0007000000022959-6.dat	UPX
behavioral2/memory/3404-1096-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002343b-2.dat	upx
behavioral2/files/0x0007000000022959-6.dat	upx
behavioral2/memory/3404-1096-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe

C:\Users\Admin\AppData\Local\Temp\cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
"C:\Users\Admin\AppData\Local\Temp\cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe"
1⤵
- Drops file in Program Files directory
PID:3404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
51KB

MD5
bcb48739cbf7d10f0e74e64bcd99064f

SHA1
7c045575b274aa29182feae65360b62941b08762

SHA256
5bb9272e9b1c822a4891f70328a9598b287f72876c4b0c4b7f0e06614099ab2c

SHA512
27a20d7722198a3e8fca6aac6c0d3132e4a90cca48101c1c413a5d8711b9250ebebbf5d4b24a0ecc7c870a1e264d836fb0769454244a49a55a0552ae4c41c7ee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
8df21cd173740c04ea1d54f6e11ea921

SHA1
4cb4516f9bff932d345fe91c811b41c4446a8291

SHA256
cd494bd40df27530d7539075fffc409040c72bae6c18059088cc12013486c39b

SHA512
063e3acf9e9bc5c308006eb495411183150893572af5ec6efa7aceb40b9737c2759b44eb199ab2ab186a20a316d2b7f9269d44ff924a47636f9c930700a50329

Download Submit
memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3404-1096-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download