a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
Size 46KB
Sample240616-a6ymrascka
SHA256 a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852
MD5 dc84ba052f63a678288feeb9657e7639
SHA1 1686e93eda6ee12dc4a0be697a331617549cde09
SHA512 dec83b6438477f87f21102e3657f34eb9b4dd7cce491368f133c329f06d911ba697e0618a49a164653ae26403016c3df2066faf658498d6b4c4448e44541b624
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWk:CTWn1++PJHJXA/OsIZfzc3/Q8J
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4520-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0009000000023553-2.dat	UPX
behavioral2/files/0x00060000000168ae-6.dat	UPX
behavioral2/memory/4520-1226-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4520-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023553-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/4520-1226-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe

C:\Users\Admin\AppData\Local\Temp\a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe
"C:\Users\Admin\AppData\Local\Temp\a09602b88bb4fd07db76540afbb526caae0777f6cca460dc75e0e77db8895852.exe"
1⤵
- Drops file in Program Files directory
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4024,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
1⤵
PID:4788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 47KB
SHA256 2f34c6b94c696f4e3d5216f01b9ec36414bd04a9f7b4cc1ff1614ca02b4b2495
MD5 66a41a45b80471c2408f5a9499b017fd
SHA1 22851efdd313027c64bec549cff8c9d4c8112d84
SHA512 b1ef72778119fa5338a2dfbb5daeb94cf227293154e8cdec7a1a7b9dd18c6cbf05e5ed16da294597c57a5fd0e4b7d3e7b56020d67865a5db1ab12868a2402a2c
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWm:CTWn1++PJHJXA/OsIZfzc3/Q8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 159KB
SHA256 d87e866ae659a81a7690b32c989fe413b7d648946f5c5b23d74c11b16fd35f71
MD5 4dbfec0622885cde8f44a148d2d73b9e
SHA1 4ec8d157c477be5d4a285d4877a86324a98482ba
SHA512 c2d8082f46b4ea09d65efb1221ca52f14b32b9415257622cf31787f2481e451453f78156285745db88c5f7ede4c4031cda68952b183ea1c4785e3b068153aaeb
SSDEEP 3072:KQSoGJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPh:KQSoGJ3a3LXGZkUcTb1JcrjQ4j
MD5 SHA1 SHA512 SSDEEP