05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
Size

77KB
MD5

d8eaf8216c42b4817d9f2172ffb219db
SHA1

ef08acb94ed654265a43e470b91ad69781c5504a
SHA256

05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d
SHA512

52c50517dc8aa60d315a5b898ae510583fda34a9deeb2eac624ec53076d3b3fa97b9e5808b1707e1a4d8118864563c6ae1e036776638a6e036c9c0328c4d42af
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8/kJOM2kJOMQv:fnyiQSo0dB

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4723) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x00050000000232b2-2.dat	UPX
behavioral2/files/0x00070000000229b0-6.dat	UPX
behavioral2/memory/4884-1734-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00050000000232b2-2.dat	upx
behavioral2/files/0x00070000000229b0-6.dat	upx
behavioral2/memory/4884-1734-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe

C:\Users\Admin\AppData\Local\Temp\05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe
"C:\Users\Admin\AppData\Local\Temp\05ec37c631bb6fa3000aa5164672a3c627f3ea7dcbc6f3d720f0402111e5676d.exe"
1⤵
- Drops file in Program Files directory
PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

Filesize
77KB

MD5
4d83346e2d9791e2186289e58b659ff9

SHA1
d43d87d2c4a705b5d4486ae589c5e42e06b4442c

SHA256
3cb7c040f329990b3a1da2ff42a1ae6cbcaa7d9f3f1eb809531a221c63d2e375

SHA512
0360c12bcf0e7a009f6c0ae90786125a89790efb171d98aea2e2385e835619fe722ea9415a6236bd74236db55aa902858f374bed53dca5547d3bfdf2ff24d94a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
07c38809aa7f5048d2af8aaa311b9428

SHA1
aaed0b8bb9701355b1161dc8966425ee0b11d70d

SHA256
ca1318d9a1becdd578c2f284c5e248e13d7b929b773996950974fc95772596ca

SHA512
f874c0c496d4b4c791d4ff31500a0aac4cafafad45b1dab8a79fd17fad8ca8d654aee302a3bffa2fd789e295c4e5475d00c35c1efb4c920d8434f2cafa6a5496

Download Submit
memory/4884-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4884-1734-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download