d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
Size 68KB
Sample240611-efs2sstglm
SHA256 d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6
MD5 3ce6614285cbc7e683b7ec8b56b89095
SHA1 ce4a8354155414403b0fa3f73d1bb8bb299b6caf
SHA512 ff41f45e3e4928dfeae61bd6db4e9c5a3789c818d923dda4a0a6de9dcf154f1eae4ac9b37681e8803ab6a783686b2def6a99d709565463b5bbef2c34a064668d
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx6:fnyiQSoH
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000900000002353a-2.dat	UPX
behavioral2/files/0x00060000000168ae-7.dat	UPX
behavioral2/memory/2652-1906-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002353a-2.dat	upx
behavioral2/files/0x00060000000168ae-7.dat	upx
behavioral2/memory/2652-1906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe

C:\Users\Admin\AppData\Local\Temp\d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe
"C:\Users\Admin\AppData\Local\Temp\d9ca0154c16f8ddfd39a47a8f13fb74b53262d3bdad17af6d6f3a85630f677b6.exe"
1⤵
- Drops file in Program Files directory
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
1⤵
PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 68KB
SHA256 bba3ed7ede09894092bf0abe99d37ef93788cc44f3633b63f8536b8adae41bfc
MD5 2144de6f2649573730f33751ecb17682
SHA1 4c5bbaa0c3213685b20b53539a659d0931d89d8b
SHA512 2661adc9525d955b1e80869abab6078f5b4a5a4bb6d2eb28a2812e80932e67ee3a2ba7c6f07a3689db75c75b9226c101c2494e844f9e3b23d6d14618d321a6e1
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxH:fnyiQSoW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.exe

Path C:\Program Files\7-Zip\7-zip.chm.exe
Size 181KB
SHA256 6b0ce45e28f66be6ec041df13d118f2aad7a038bef2793fadae83e86774747e5
MD5 eccdf658051d297e7f63fdab4917d071
SHA1 3eb29bddeeea364c4eb53ec50edd90cd76e63731
SHA512 dcc55f012ec1d1d6dea6f58661edf1586d67b48a75d22dd3b319e5e3fdb484e5790a024402763df7e0b3702fbf6749b6fa106826d642630fed45194b457bede3
SSDEEP 3072:fnyiQSo7J3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPh:KiQSo7J3a3LXGZkUcTb1JcrjQ4P
MD5 SHA1 SHA512 SSDEEP