61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
Size

127KB
MD5

dfb42a94d2134dda7ade56463d571c9e
SHA1

3ffb9e64b767dd693c2c1eb320915a66d5712adb
SHA256

61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f
SHA512

b0cbeb42b15b090b6850290f4e53dd50a24671c5e5d8f8d78c6b492dab84457dbeb6623ae56895815dfbd7937b497a961aadbd3d7c63a802448a37eba6f8a975
SSDEEP

1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCC:fnymCAIuZAIuYSMjoqtMHfhfr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4831) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000a000000023400-2.dat	UPX
behavioral2/files/0x0009000000022979-6.dat	UPX
behavioral2/memory/1148-1760-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023400-2.dat	upx
behavioral2/files/0x0009000000022979-6.dat	upx
behavioral2/memory/1148-1760-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe

C:\Users\Admin\AppData\Local\Temp\61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
"C:\Users\Admin\AppData\Local\Temp\61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe"
1⤵
- Drops file in Program Files directory
PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
127KB

MD5
d1482a7e0d0eb5c5bbea4e7658866a4b

SHA1
ff12f6d1250a3165afe43c5101cfe21f03628131

SHA256
c213a07d0f47be848ed01a9a6663728cadf9ea151f76cc85e43a925e110e0ce6

SHA512
568ed9827db87908c62f2f80f36363ec5122b3704005b77e6388725539a18a29b0073f8496f2b900555418b976a1791fd3fe2b3869a6eff037ecb73310469beb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
226KB

MD5
5776374b02e2e4261322ff66131e4905

SHA1
59d1298ad7c170c6688155cbfca3950e3c319dd8

SHA256
113b49cf5b7ec5bdd63169efabc5967ccf0a70278bed2d6b272cf81df821648c

SHA512
d5cad92c2534fc5f87d41790a9a3be35dc84b2b039d55c6f21c06d6c966f768b11039b469397935e77c1f39a1e54a0cb2bbe106e8afa028857893f3058a79b0a

Download Submit
memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1148-1760-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download