1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
Size

54KB
MD5

520ad000928ff20c7b0d1000827b7304
SHA1

045b3784c0517b32b11df0e2317d3fe5213b7188
SHA256

1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43
SHA512

e76fa93e6eace5e85d5cd4d932a7cc0571bdb78693f388fafad44f58f0312161874af626b7f08b67061896981cbce22aeb3aae646675367ceddd831001d581f9
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzl:CTWn1++PJHJXA/OsIZfzc3/Q8zxL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0006000000022f3f-2.dat	UPX
behavioral2/files/0x0008000000022999-6.dat	UPX
behavioral2/memory/964-1110-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0006000000022f3f-2.dat	upx
behavioral2/files/0x0008000000022999-6.dat	upx
behavioral2/memory/964-1110-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe

C:\Users\Admin\AppData\Local\Temp\1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe
"C:\Users\Admin\AppData\Local\Temp\1ee35090627919988d4d2994ba85547650f6d96c0484df60e246dcafb67abc43.exe"
1⤵
- Drops file in Program Files directory
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmp

Filesize
55KB

MD5
479a3d2e882e6c3b5684cd7a92636626

SHA1
2d0833b623d6a9c83f0679a8f24f7e80427a2c4f

SHA256
2f24bc96e638a4cd9e70929ef5e49c7fdffa316da28ced1d7ccbb3bab5f5431e

SHA512
c0e63c5120be676834a03c04af625a2782e819251877919801b55acfa628c97a9aac066ec24931a61e0e47de6d2d14cf0753e65852ea13030b80c54263c3a633

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
c4079833526ca05086a055f5d695b8ac

SHA1
116c510a2d3f3ca75e6e6c66addc0f156286db38

SHA256
0024eec9cddcb3171079b28b5239544b74aea63250010b3d79b859323c161a64

SHA512
32fec3f68cff9f5aeb5b78fc59db2658971e6e233a13119530fa7e51ef4be4cbad90974adb7af70d2d9e7c3ce86f83ee81b09f0967c84cc4a8d75d370271756e

Download Submit
memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/964-1110-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download