9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
Size 45KB
Sample240614-bwsjeszdmc
SHA256 9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b
MD5 7a08cd7421ee9b41f36e6772cbe86dea
SHA1 8b30e39cc2aaf19a0c2a42de691575b3c2b7946c
SHA512 28cc9ea0eac5ecdedd82ba7116b7c9f67a65dda3d52bd2edf32a1fe157c6811bd3e754291e230b857c411504e270ddd03242a573a15e189c4ab4f3c1c05b2d27
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFwV:CTWn1++PJHJXA/OsIZfzc3/Q8wYG
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2476-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x00090000000235d8-2.dat	UPX
behavioral2/files/0x00060000000168ae-6.dat	UPX
behavioral2/memory/2476-1222-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2476-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000235d8-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/2476-1222-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEWDAT.DLL.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\vi.pak.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe

C:\Users\Admin\AppData\Local\Temp\9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe
"C:\Users\Admin\AppData\Local\Temp\9377ffeb3438013a51fc5c19020161c672ab5e6a58c6a4e212bf8e485cd19c6b.exe"
1⤵
- Drops file in Program Files directory
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 46KB
SHA256 e98f1fe2ca68b6756d5b57325d53511f838c7d38e0b3cc2749f5752aae416e05
MD5 c90e9cbdaf74f86777321953b599a203
SHA1 e372c5cd652baca787a026e404913e30c7125064
SHA512 fbabd3025b12eedb7a2119113a40d2f18607667accb89cda4773ea9792fef62a30c4556ed2bd85ed6c2360e25c8f01c79f3491e0e87d02c9edc1f7078a74dc17
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFwN:CTWn1++PJHJXA/OsIZfzc3/Q8wY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 158KB
SHA256 970ec960d66a96101b40b93d1fe39004e4b47abd819f56ba6c9c5333a3a4920a
MD5 dd7405cd96a7055397bdf5a83bf4216c
SHA1 6d09cf9a609fcc9bf4580b6f8a4b57a032f64b71
SHA512 584cf3a42043dd8a757c40d33fb624efb57bed5626c7d48c701ece738397e303bed22e8c2eeddc1bafcca4fa6f990033b07d9e2c20f61e184d503a2a312afb34
SSDEEP 3072:KQSodYDJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPG:KQSodYDJ3a3LXGZkUcTb1JcrjQ48
MD5 SHA1 SHA512 SSDEEP