cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
Size

111KB
MD5

38b3a669dd4531673667b4d8e9e5f335
SHA1

c8f0aefc0400d6b13d02497f1570e0d984d6d396
SHA256

cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163
SHA512

52133aa0ee1883fbfe276f5d16c57ae98332b6a93638f43245e871edf9e7a14bd2fb7972c9ab1aa6ea2f6e7c1c69f417f5372a4016fae13993aa35fb5e0f24b5
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q85qgnDfdPux8I20AoGjv:fnyiQSoCqgnDF2vIr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3376-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000500000002326f-2.dat	UPX
behavioral2/files/0x00090000000233c0-6.dat	UPX
behavioral2/memory/3376-1788-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000500000002326f-2.dat	upx
behavioral2/files/0x00090000000233c0-6.dat	upx
behavioral2/memory/3376-1788-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\external_extensions.json.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe

C:\Users\Admin\AppData\Local\Temp\cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
"C:\Users\Admin\AppData\Local\Temp\cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe"
1⤵
- Drops file in Program Files directory
PID:3376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
111KB

MD5
f5a7010898ea77fb42173acf41a108bc

SHA1
7d39e269766de8c557497d7d2e3c3a09a5e2e3f3

SHA256
858fcc8cb104761b337c132ddc85d843092961b0900d49773798d4326b4da18f

SHA512
f08eed3c3845f4dda288cfc3a1770a8756e116d0a0221401e403d7c7c4517c167882202232a64d5d7a1c662dad2e49e9e6db5a57ef5fad616c5738edd672f916

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
210KB

MD5
de22a7247119d3dcc4b9630ea9907348

SHA1
70493d8c5e295b53bde0058b7642f98d6c9fb54e

SHA256
2e8ad838cbcd9e5d8e616ffee1767b9ea0d33cedca647ee29feb6762949bef3d

SHA512
d38325154230a6bd04c264e1ddcad09798bdb6bb90beb68d46b797a6c750a24d14c96112760b6903236af830117f02a18048acc0044e409b7e7a3f57dcf8da83

Download Submit
memory/3376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3376-1788-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download