d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
Size

90KB
MD5

e09f01362508862188b1613bfe934370
SHA1

e9ba0f267ca0cacff6cbb3a47ca8271b036fa222
SHA256

d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761
SHA512

f9590c843fa0de1ab233bbad2af4f5cc66908ea7ed37efcfe9a86ed4415d3ec95150cc61aeec216f1e45ea63b5008f23ef7f4ed3b02816cb782749d921906f8e
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8VCnXxX81jmQJHdJH7XOXeXOXh:enaypQSoPXxXV

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4915) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023679-2.dat	upx
behavioral2/memory/2632-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000168c1-6.dat	upx
behavioral2/memory/2632-1786-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe

C:\Users\Admin\AppData\Local\Temp\d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe
"C:\Users\Admin\AppData\Local\Temp\d8020f7f9412576a32df83bb5ae683afdced9dd5e38569e0b54907d7e714f761.exe"
1⤵
- Drops file in Program Files directory
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4532,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
91KB

MD5
9dff37133e08726d2b34475b783f7a6e

SHA1
bfd36fc7ec124cfeb560506546cc57608daaeb55

SHA256
4e0d275a8a6961b10ae0db38c06f7fb7288269b568727e97d9c12c375c3922a7

SHA512
38bb63dacb86625e2d957f6bd1d9f95817fc51aebb45d3578a73ddeb287a6b3a183f88e1e37621c6611d5f2d79e529531e6bea1d1a2206e9122fadf139f8ff78

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
203KB

MD5
27a9c7b3e3364c238d3349831eff4c73

SHA1
1e863cd6bd7374dbd768f0e6085e7e2e8f990163

SHA256
45a7841617050894386ed82c4ec2f41041d63eb0ff3058a459bcc560ce2d75d2

SHA512
8702a49712fec77d100be13cf701232908a75cb13720611a0e52179edab915fbbca719fe2b5d1a7f54e335fef73c2a59fe9b14a267a9c9d67d5457d91548b204

Download Submit
memory/2632-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2632-1786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads