7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
Size

73KB
MD5

45c0e5456b0a8d0f89fcd0d8752fc5eb
SHA1

282f39c8f5619a5d103888f18c7aa8817b98c5e8
SHA256

7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e
SHA512

426d609fcc33480e37aceaff97324535365640d1db4a6c5ba3157c91cb1510868fdedb876014a517b87d37a502914a042a127b4a47d53a3d38b89bcf635965d0
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs24Z:+nyiQSohsUst

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5003) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1764-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000800000002327d-2.dat	UPX
behavioral2/files/0x000800000002294e-6.dat	UPX
behavioral2/memory/1764-1784-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1764-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002327d-2.dat	upx
behavioral2/files/0x000800000002294e-6.dat	upx
behavioral2/memory/1764-1784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sw.pak.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe

C:\Users\Admin\AppData\Local\Temp\7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe
"C:\Users\Admin\AppData\Local\Temp\7db84df5acf3e6b4928c2a2f08791c585a495d9b07e923b90cb90d2e48bcfd1e.exe"
1⤵
- Drops file in Program Files directory
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
73KB

MD5
59ef085171e434f1267e8be67ca6c073

SHA1
433dc6e84f156e11bc7209b593404c7a4dac33f6

SHA256
18ea69b3b0e181ce6dbdf74f0d11b4a2f4acc3e53a32621975ebae3ba1d20b38

SHA512
4f6f840bf9cb956b03ddb279c95147299a09538f08a4201d3a797f91167d48888238b4deb25902340b6a4617e1033c02bad787a49ab56ac3e8d646a1d584a355

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
157b7358884bf3645183266baa5315a7

SHA1
49d67a8d86029f00062057c0dae6012fae0d4774

SHA256
00de774a69cb5bdb1f5e926b0dd0fa05b00305f4e3e823ddb25fd1cfca1d0ff1

SHA512
c704d8437698478e94f91ea409449814bc6332f73666e4c598e40b338a0d405fcfdf6348fc296cfc8292951d8d6d26841a8e3e3f88721bf35d9d035d466540ff

Download Submit
memory/1764-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1764-1784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download