899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c

Resubmissions

05/07/2024, 22:36

240705-2jc63szgkb 9

30/06/2024, 23:59

240630-31zxvashpn 9

30/06/2024, 23:55

240630-3ym59sshjn 10

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
Size

90KB
MD5

6222154957fbf89f273719c001f82a6c
SHA1

14a13a772f654c8d46de97e56db3e75ffaeb86fd
SHA256

899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c
SHA512

6bf4e345f1ac322a7fab6beca852765ac369b7bffd6007b272aa5458f4c354804f891a4aa5d22c4fef60dbb5e0e5eb37645bfe98413f4de91b8e925294d13af0
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8VCnXxX81jmQJHdJHr0GUykUyN:enaypQSoPXxXTke

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3952-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0008000000023299-2.dat	UPX
behavioral2/files/0x0008000000022999-6.dat	UPX
behavioral2/memory/3952-1248-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3952-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023299-2.dat	upx
behavioral2/files/0x0008000000022999-6.dat	upx
behavioral2/memory/3952-1248-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\mojo_core.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe

C:\Users\Admin\AppData\Local\Temp\899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
"C:\Users\Admin\AppData\Local\Temp\899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe"
1⤵
- Drops file in Program Files directory
PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmp

Filesize
90KB

MD5
da9cf5fd5fe16bab00d7ac82b494dae9

SHA1
5852b37a34ab6881c972510e274a905cdbb0aca5

SHA256
a768e678a4d83949c61836114a00494db1c2653b3e842bb6e6a1fa778d3ee9bc

SHA512
44a8eab9083a8a2399d84e1cfb77d6be81d8bf74a17f2ce919bea39093e8d6e32fa87d94e7d1062a111f3c9fe5dc77727217a504f02fa04ca0daf8911e2b4d58

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
98d6499d91e3afe25374fa3b53c5af9b

SHA1
d6747ed98d367a8a28d9df10e300ebc1d9e40440

SHA256
2d67cc3317327d72c590207904f151e081cf3331cc9e4b3e878116d913cdaa3e

SHA512
f9ee5415f599ac4e0edeaca30d2d677203df552ac7276c038a2d0dcfb9ff2f316c7261deb4ce61cc1b000da13aeebfbd8905739fec4bd106023b6bbbb54720c8

Download Submit
memory/3952-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3952-1248-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download