5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
Size

45KB
MD5

963d5f40ecbfb2d8366b9a6add324416
SHA1

0837e1a2ac7476a31a4d059e03dc9514e272b860
SHA256

5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9
SHA512

00b82d08434ed8f7bb701b0933efd7159ed9288c348dd2b52e5e1779fbbc1c0b9ee35d88a9903cb4609059f416d967d98172d8bb0a4e2e4c4d38625b93a944c8
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzb:CTWn1++PJHJXA/OsIZfzc3/Q8zxEU

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000500000002328f-2.dat	UPX
behavioral2/files/0x0008000000022970-6.dat	UPX
behavioral2/memory/556-1214-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000500000002328f-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/556-1214-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vulkan-1.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe

C:\Users\Admin\AppData\Local\Temp\5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe
"C:\Users\Admin\AppData\Local\Temp\5b6c90d4218efbcff1ed4dc63009176540db06d5acd21ee538d8216a162aa3a9.exe"
1⤵
- Drops file in Program Files directory
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
46KB

MD5
0a3689690daf2af39ddcc1f7be8da71f

SHA1
b1b642cc84c2ae42b7f8acc808b1289ac9de8e20

SHA256
71c0eb29f644669335a8101c7a9aa90d481cfb9400813fb7013bb8d154f9b46a

SHA512
d591afed7f092806df42d3488c6b5d3f839161b0ee3599505db3233fa4d7bf6b35d7aadf6f4d1e6cb35a59ee6c6d6cbb2bbf1620dd1d0b318cfc6a23941089c7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
bd475108e04acfd121b1ed7a87a8a3dd

SHA1
f4030b85f571ce356e9014bc4ba302e2163ed2eb

SHA256
22f9de80c4cb9c552aae5aca1ee11a7ed0ca9713d8887ff0772462e36b751723

SHA512
a2e985c390510cb5c8566daadfa76a5499f15dc00e5499ea9ec2dae04e5a6128e0c2669ff47a662db2f383d783581a1b6a01853846cd9bfdbf97d4789457110d

Download Submit
memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/556-1214-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download