fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
Size

46KB
MD5

7445b662b27b48240f452b24f42f2ef9
SHA1

c6fd8cafb3c32fa2ed00be9b7fcc83999efbe920
SHA256

fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53
SHA512

2087695ac28153eabf97a259f822e66d21cdff89bc8379bf7f71be1e5d69e80e33b5e303a55b49fd25ebfe4d5b54caa5824b7788ae82ffd3dd9765260b67d0b2
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzT:CTWn1++PJHJXA/OsIZfzc3/Q8zxJ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5340) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0007000000023276-2.dat	UPX
behavioral2/files/0x0009000000022975-6.dat	UPX
behavioral2/memory/1588-1222-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0007000000023276-2.dat	upx
behavioral2/files/0x0009000000022975-6.dat	upx
behavioral2/memory/1588-1222-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql90.xsl.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-string-l1-1-0.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe

C:\Users\Admin\AppData\Local\Temp\fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
"C:\Users\Admin\AppData\Local\Temp\fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe"
1⤵
- Drops file in Program Files directory
PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
46KB

MD5
2b4e74c4fd4698d8971fc04113fb0ab0

SHA1
83311712764386540282fd348daf58994e331927

SHA256
1c9944e116ab3344deee6c186f3182a7cf240aaef762e8dadc6145e9ab1e37ef

SHA512
24254704f5d2e6bacbd58a2ddfc092e294474e6b9ec059c68843e54ed178ca2569bc443ee35a751e92a07eb165b74f62275dfde85e5638e34130a0218e559d01

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
4db08a402159d9fa87480316212357d4

SHA1
306b5dc0978641ed46110d61a04d69847232f95b

SHA256
772c8195ce46d5192cb4e8542405d6c7bcd0e9f6de411be08cff6fb78877e5ac

SHA512
6ce61a842bb4ab7c63ea4515c7a581e3fe002e86e7ca118325a2f4c872c19259c2325581fe9de7a2ccf334a3512f11d12eae67cc026729a9e670a62ca279f709

Download Submit
memory/1588-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1588-1222-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download