c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
Size 65KB
Sample240612-eppqqs1ajj
SHA256 c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d
MD5 7c675d54f2103b7b84ad0f515c26f3a2
SHA1 af554e2cc69e075d565890459d7ddae27d056f5a
SHA512 c3ee2b0aea0fbba65289ac6f28c496b66894fa678096896d15fad8798a561cd7c504cc853296c5311ee0ad7e658c5299b3baba2f1d90c8d5f51a76194fe00dc4
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFaU:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJO+
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000900000002353a-2.dat	UPX
behavioral2/files/0x00060000000168ae-6.dat	UPX
behavioral2/memory/2652-1222-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2652-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002353a-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/2652-1222-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe

C:\Users\Admin\AppData\Local\Temp\c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe
"C:\Users\Admin\AppData\Local\Temp\c7c9eef9989d42fd7af0ce6d04b02284806b7ebc15d96257363a1df689498f5d.exe"
1⤵
- Drops file in Program Files directory
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 65KB
SHA256 969df94487ed435c37be468de7e16a20c13765240b7b7f38ef50b69b1dfbd30f
MD5 2124a4f40d42ad0aeebfafc6cedfdcb3
SHA1 24805f7ecee3c8eeb54b732698287036daef6007
SHA512 1b9ce0565941f46f903ec6f3e126a11d1e553eae8e0a9ec9adc564b62aabf8dbf760c02f6cff96ce6b8beb2a829698467df04ce3325f54ddb4e480de8fb5c4c0
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFao:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 178KB
SHA256 a56a4913ca51075f768ede6808cfa625c3680b08bfdd2cf8e2900413131a631d
MD5 d025adad1132cddf57f1987f33f91120
SHA1 60b2e10e32ae4ae14350d82a6763e3bd9b5c05df
SHA512 efd943a805b94e8fdc773d6ca9b4441d585b43a9bce079c59a960a5700cc3c2e3872c511fdc84b12de01432bedb1409eef7f1779b68994b1b5a043faf53e7a3e
SSDEEP 3072:KQSohsUsFJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPK:KQSohsUsFJ3a3LXGZkUcTb1JcrjQ4E
MD5 SHA1 SHA512 SSDEEP