caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
Size 45KB
Sample240611-dqd5yssblb
SHA256 caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12
MD5 9e344e40765c687e74586eed8d51bbbf
SHA1 44cf869d594e19f33b67c7cb151aa87e23f2e6d4
SHA512 2e753d408582f5562e6772f430d2d6eca0298e3f80ab7ea4467378b8aa0dee5029f3c8882512edc6ed034d94bad17d5747dee369d33994da22bdea932cfd54fe
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzc:CTWn1++PJHJXA/OsIZfzc3/Q8zxy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0005000000022975-2.dat	UPX
behavioral2/files/0x00060000000168ae-6.dat	UPX
behavioral2/memory/1640-1232-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0005000000022975-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/1640-1232-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PRISTINA.TTF.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AirSpace.Etw.man.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe

C:\Users\Admin\AppData\Local\Temp\caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe
"C:\Users\Admin\AppData\Local\Temp\caa2a47e906ff7b4d8a2cb55f36dfbc2aad1bf88be1cc38dcdfaffaae5f92e12.exe"
1⤵
- Drops file in Program Files directory
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:8
1⤵
PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 46KB
SHA256 0a20c34608a157ba01ba179473b64a896d8a7ad97c86e9173d252b6053fcc16e
MD5 618de3f5e9f93e773f2717a2c6e73835
SHA1 f2487db9b3fed018143d9ceba088180f558d67ab
SHA512 69cc9756a8a181b76201f290c50a8decec491082a77a847f880b05a1fb735b96e0907381b91558c76cfbabef34b718398de89a831d7db8dc7203bead5d3d0daa
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzf:CTWn1++PJHJXA/OsIZfzc3/Q8zx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 158KB
SHA256 4b46f3b80b008732476f891762799889b78e952690653cbbb8b507db67c43d88
MD5 49035d4869fc2ce55add2aebf2c8adc1
SHA1 811994c7f0750a60ad96ba7ed3e1014ae2cfa122
SHA512 c6ef7b9a771dfd9db4d0cf4f2ba30de7f635cc851e4a18df2e7419d46e4309f0edd3d905c4fd0f825ea83f4258d1886b0b52d3d14318f2aa35045341eaa860c1
SSDEEP 3072:KQSoxJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPm:KQSoxJ3a3LXGZkUcTb1JcrjQ4c
MD5 SHA1 SHA512 SSDEEP