9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
Size

48KB
MD5

cc3be63767108d1ee534a513c081dea9
SHA1

276b5318a919fbb41f41466f95b467847f22600b
SHA256

9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d
SHA512

6a1ea72fa4cd4d220eb182c09de0b2fc05d1a0829255fee4ccb114ea9cc753eca588d8bb1fdbd3f505dc94e4f5c38e0bad0ef5ce368fbf0c8fa2f3ef38f76476
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzK:CTWn1++PJHJXA/OsIZfzc3/Q8zxDCuy

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000600000002327c-2.dat	UPX
behavioral2/files/0x000800000002295a-6.dat	UPX
behavioral2/memory/448-1056-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000600000002327c-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/448-1056-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe

C:\Users\Admin\AppData\Local\Temp\9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
"C:\Users\Admin\AppData\Local\Temp\9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe"
1⤵
- Drops file in Program Files directory
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
48KB

MD5
3c1204f568bf0649457da7136670240f

SHA1
27b2aed3fb553bc718baadb021b8858c690d3e18

SHA256
b4c5019bbe039d1204c62ce83602985cc6e331a51c435ebf24490d8588abfc77

SHA512
cb479aaf0fb21c3051a8515f9d7163016cb5e2f7623c5c61f9320990fc41fb18056af437955a4ee7d40809adc76980a8034170b88baf1f4c452865ae7bd8effc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
1fc139e68c74719c970341a8fc470540

SHA1
75607b2fffdc4109e16e07da6bbeac427f7175e2

SHA256
059d4e3e97566df960fef7784535efcc6cf81230a09c36bcce4e260b758c4eaf

SHA512
8741715c3caa012d2607293c79fe521cf568d7c5ebefe716953f835b1e0424d8ea69e47946085eb71681e415a48d6e329c74b85a16001e670bf923899cd3c555

Download Submit
memory/448-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/448-1056-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download