0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
Size

49KB
MD5

7f5ba9a9c4e6f22eb823ca7baa46cd13
SHA1

1824cbdf62a98c503d87385409eef1271fc244ac
SHA256

0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96
SHA512

899285a9f14edd6646632b84a47256e5727b9d4b94cbc53e8778cb9244103311cbf6d561f619f10422ec38b666554753964994092e122b3bcc36542c19d5ee07
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAF+b:CTWn1++PJHJXA/OsIZfzc3/Q8OySUg

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x00090000000235e4-2.dat	UPX
behavioral2/memory/4744-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x00090000000168c1-6.dat	UPX
behavioral2/memory/4744-1133-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00090000000235e4-2.dat	upx
behavioral2/memory/4744-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000168c1-6.dat	upx
behavioral2/memory/4744-1133-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx.tmp	0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe

C:\Users\Admin\AppData\Local\Temp\0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe
"C:\Users\Admin\AppData\Local\Temp\0700bad8788ac83de4f931ff2a38ef152fe848970f05b89ee98933e735646b96.exe"
1⤵
- Drops file in Program Files directory
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
1⤵
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
50KB

MD5
0d5d0b8366107b4417b00afe8d79a0e9

SHA1
a45f4b4f14abf7bc234319e75261f10d0f9c207c

SHA256
ef87fd6ed3d3de2d38df86540746de507aaac2fff4f6d5de50dcd4749263e67f

SHA512
0b0821b91b0d22416b9c1353f4748920fbcd42bb19a9973c353d42c3b918236ba6787445c0ef85319eb05e1b0e469d626b014f5512e88b698251cc53aad440f6

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
162KB

MD5
62293e49529027880772de89bfaa4e21

SHA1
2001e51e26449a519a4afa09d754fed757287f73

SHA256
2fb1360753a357465e6b318598df268d73eb95d7f39c25b99c14807f4959a2f1

SHA512
f56d387071da2295e798c65215ada3339a3dafd36dce87484bdd7506abbe4825b389d90162d657c8241692ed38d984a2d84d16a6db038df9f8fa0799cf4f7546

Download Submit
memory/4744-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4744-1133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download