eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
Size

113KB
MD5

fa15ff775c696192145abfa4a9ad604a
SHA1

c5c917f0165e49e78b74236f6c5c3a59dae26791
SHA256

eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e
SHA512

03a9a77cecf543af702a709a3392a474e1131127a673f931ccf11d738c9f63bf92952eccb0cc2e33c078d0b666036c58ed4871c2d180a246e0f93562efda8e74
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfagM:hfAIuZAIuYSMjoqtMHfhfagM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4883) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2352-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000a000000023413-2.dat	UPX
behavioral2/files/0x0007000000022983-6.dat	UPX
behavioral2/memory/2352-1044-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2352-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000a000000023413-2.dat	upx
behavioral2/files/0x0007000000022983-6.dat	upx
behavioral2/memory/2352-1044-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hr.pak.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe

C:\Users\Admin\AppData\Local\Temp\eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe
"C:\Users\Admin\AppData\Local\Temp\eb30856e7473bfc9ed0aba76874146c8864be2547f9d5ae98b39ae0eefd6075e.exe"
1⤵
- Drops file in Program Files directory
PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
113KB

MD5
80430ed9a78c12b6281d9fa68266c13f

SHA1
383eee2b914003ecc0dbbec1c284378239167f83

SHA256
0c365ec14262c46710feadaa28eda90ca8e375dc77b024e91fa27d3583b76bd9

SHA512
0e4504bd16c1ec8860d4ed3c9a3e5f45a71491cb5f76c405d8fa78a04835ef6776a257112b131c4ee85b40b02be5e568ce693570804b7cc40e3ddcb800be61c6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
212KB

MD5
bd7839b11ff7bbcf5ca041c07f251476

SHA1
9e290d9cc01efdfe829f7dcecc87e30325e6d7e9

SHA256
446982ddaeee7961092466de69b3d9f7d426810e5f302b34b8b3e8c287db3c88

SHA512
e2a79bb61d5384b3c9d9e30323c66944e285802edb9724df740d3d99fd21ded305fb28fe5a7e1e50b90c6e1576e2e86ebf24e639f6ea572537c125c2fc9fb8c5

Download Submit
memory/2352-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2352-1044-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download