bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
Size

69KB
MD5

f997e599ed22fb4bb4713de12448f793
SHA1

433d2cf761cbe918f53558fed97f2675397f0bd5
SHA256

bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc
SHA512

a933f8800995cd16d9616154d93d96a196936d7b8b317d70dca59bf56e110aab64077b3354aced110593aac363d14b9bfdab0248a141b7b103624903c552f836
SSDEEP

768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniX74l4O:a7ZyqaFAlsr1++PJHJXFAIuZAIuA87

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5012) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1008-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0003000000022aa2-2.dat	UPX
behavioral2/files/0x0007000000022959-6.dat	UPX
behavioral2/memory/1008-1792-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1008-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0003000000022aa2-2.dat	upx
behavioral2/files/0x0007000000022959-6.dat	upx
behavioral2/memory/1008-1792-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe

C:\Users\Admin\AppData\Local\Temp\bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe
"C:\Users\Admin\AppData\Local\Temp\bd4fd59f40ea677d6d19ed43395772faf8174b91b19f3cd1d41b8390448ea9fc.exe"
1⤵
- Drops file in Program Files directory
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
69KB

MD5
42715c803aca1b29ad0b91b3c5fa2522

SHA1
f03e932c832d4e1c01c3acfef7387d687493cf13

SHA256
0e4d73189331e5cd33612e20084e30b48b30b67314e216037bffb8bdf9068867

SHA512
9ba4f2d1eff9941d23e7dc7046a3e20fdc392a3f41ba66aea67bd63e268ccfedc2fcf2ccd72ac1956cf9fb96988fc6b71dc6c364e9513ffd7bcc5fb0dc893b06

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
4a7bf55e4d045cf2fe46c074880005db

SHA1
ef57b26a0208cb9e288d6ac975c5792aecab26af

SHA256
149fe76079d4d408d094001f796a671553a4bfd46c2276292cbf2270230e20ac

SHA512
24963dc1103110988c0c6c0ee1ed6a0e7c6a58dc01f259358a5e4191651da5b5673dc3f754cf638ba2f2bcfc5067fbe83eb81f6035eb06bb397e3b31038a60df

Download Submit
memory/1008-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1008-1792-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download