276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
Size

81KB
MD5

841f39ce6d6f4f5f16ff925ed4ea5ecf
SHA1

1e1a7266701b2847013e84d7171a2c46c85e706d
SHA256

276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4
SHA512

9c3cf59dc48440c049bce88dd222b942d82acc8172a27173a709c916abee517631e1871756cd48788388357320ded4dcb0becd43cd8f72e2540c062b638c766b
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8olP:+nyiQSop

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4600-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000b00000002339a-2.dat	UPX
behavioral2/files/0x0009000000022979-6.dat	UPX
behavioral2/memory/4600-1954-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b00000002339a-2.dat	upx
behavioral2/files/0x0009000000022979-6.dat	upx
behavioral2/memory/4600-1954-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\external_extensions.json.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe

C:\Users\Admin\AppData\Local\Temp\276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe
"C:\Users\Admin\AppData\Local\Temp\276f6c9b0bc8080895bc4a9deb0495305f585d24503c05b4843dae640e6ccbf4.exe"
1⤵
- Drops file in Program Files directory
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
81KB

MD5
629e4804b20643921cfec755301e3e07

SHA1
9d50c88f2e7b981c6a9d984d025a5598aefdfb52

SHA256
889bde31299d0bf83d231678b75e2bad6eeb0ff9dd136cfbcf6a2a3a14256a8e

SHA512
d8ebd8ea3cdf55727ba3f22a132c646aa3c1804d95aecbfb65cbf346a75b28615e10e5752f88fbc24986179699052a637e3803cd7a423a982501d5744ce613fb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
c0d649d332c66fbc8fce63f8cc825d4c

SHA1
542bd640bc776301a210ea2bb6b43aa84884ab40

SHA256
a446f28f0f1b149811c715e724e4eb9ddba59ef0d93e35b0c31b3a1ea9af327c

SHA512
659cbc0e91e3c0a29eea267afc52f82bdffbfbf0dc274d2583d24ab6204983cb3bb74580ebac18a27f7322defa8fb97b2314c5d426dfd00e202c87eae475b233

Download Submit
memory/4600-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4600-1954-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download