5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
Size

134KB
MD5

17530ad7ad771f87f7b0efcd6c04bc58
SHA1

bea0272341ef7516cc4fe5d08019d5f73ed4ab38
SHA256

5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866
SHA512

50b28f6e4db7521120dad5abcaf8e66975950cdb40f1203895ff88487914c475396ace9fd6425c32ca649f8a411d7faea3ffe416026fac45cd1952b1b114b2b0
SSDEEP

1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCo:fnymCAIuZAIuYSMjoqtMHfhfagp

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/528-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0004000000023266-2.dat	UPX
behavioral2/files/0x0007000000022983-6.dat	UPX
behavioral2/memory/528-1740-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/528-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0004000000023266-2.dat	upx
behavioral2/files/0x0007000000022983-6.dat	upx
behavioral2/memory/528-1740-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe

C:\Users\Admin\AppData\Local\Temp\5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe
"C:\Users\Admin\AppData\Local\Temp\5a5fabfd5337e93ae106537e5ed7093e0d0d03d3623c7002d2b62bf03776c866.exe"
1⤵
- Drops file in Program Files directory
PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
134KB

MD5
2da03967180e1b8d9e10ce9f60f53014

SHA1
75c889c1f6fadc880139cac7da41d0286f2a9ebc

SHA256
7da03579c29702982f706e2f31ae9e8145c6b0061dcd94419c4f9de8bf694a5b

SHA512
9808bda3bca661b64e7f2872bb6d94027fd7d0888cb75765e22eb7b9139e15a1bc103f62f6027b76e76e81085e2bbfe79613572953e4c596866b4befc6da391b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
233KB

MD5
36f68a130a39e6c7bb4b94f45128717f

SHA1
9337818b31ae665358e23fd693df60791183785a

SHA256
0acaa953618b339687c963cd6ed61eddebe7273872fa19db68a67e53706f999f

SHA512
a3931c37b7c50c3097beecfb94ca98b2b06ab99c6e9baf999aa122b3a555d104c6ccaf5bb6fe63442f318b1f08698dfd1f2216eb851e70b07d17ba26ca19fa03

Download Submit
memory/528-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/528-1740-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download