1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:23 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
Size

53KB
MD5

707c988b099cf8e159882d5890ef519e
SHA1

54cfebb350d80a4a1382d4f49e480e3d7de05908
SHA256

1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26
SHA512

b98d9826ee684e72e1948d106cc6b94e817697434f9fe108977950f68d53025ebb8edd61046293fb077f19db3522846b17daa855d853f913d2f0b74a189b17b1
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWn:CTWn1++PJHJXA/OsIZfzc3/Q8O

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3500-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000900000002351c-2.dat	UPX
behavioral2/files/0x00060000000168ae-6.dat	UPX
behavioral2/memory/3500-1216-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3500-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002351c-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/3500-1216-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\msointl30.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White@3x.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe

C:\Users\Admin\AppData\Local\Temp\1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
"C:\Users\Admin\AppData\Local\Temp\1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe"
1⤵
- Drops file in Program Files directory
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
1⤵
PID:4532

Network

DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

138.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

138.32.126.40.in-addr.arpa

IN PTR

Response
DNS

82.90.14.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

82.90.14.23.in-addr.arpa

IN PTR

Response

82.90.14.23.in-addr.arpa

IN PTR

a23-14-90-82deploystaticakamaitechnologiescom
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

98.58.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

98.58.20.217.in-addr.arpa

IN PTR

Response
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

80.90.14.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

80.90.14.23.in-addr.arpa

IN PTR

Response

80.90.14.23.in-addr.arpa

IN PTR

a23-14-90-80deploystaticakamaitechnologiescom

52.142.223.178:80

46 B
1

8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

138.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

138.32.126.40.in-addr.arpa
8.8.8.8:53

82.90.14.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

82.90.14.23.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

98.58.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

98.58.20.217.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

80.90.14.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

80.90.14.23.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
53KB

MD5
cc54a68f05deb2574e8c6386f81df812

SHA1
56bd1392db818c7d139c761440dcb14b37dd32ba

SHA256
d07076fd6eee849147bf73a12afa31df299dc2b8610d9a0de49c849967c4a854

SHA512
920482f37f33ce45781d14275efe39e154486723250527b222ad0bf3a7b0fd2562e52e564f3c415b53babb981a944b31927684a836084cfcbedd5448f8a9f6ca

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
166KB

MD5
3ff011eab6ddfc12119dbc71d9d46587

SHA1
51848d0633ab9d8d352b3dee8106e73672a3e071

SHA256
a1a384b26ff2580780323d7bf9039906896cc02473d4e447360155a9ed03e6ca

SHA512
f948ba8e1a094ddfa3f8c7814318ace158c794dad1a79a6fe8e1388125ed3399f53241019303e141b33b7d35ac1ef21d89a3bc7d46f898436a96e5e2c571d540

Download Submit
memory/3500-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3500-1216-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.