09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
Size

48KB
MD5

879111f6d6ff4032105e139410b904a5
SHA1

cf055acf1f5b1fdbeb33e945b0d3d80d1995424f
SHA256

09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa
SHA512

3e838665d468f348b7596b622eb3b7ae70c9acc678f74011f7725f416bb0ed5757c5bf62afbcb2941ed6ee20aaa5be7d87b5160d5d1ba3013dc93dad13530cc6
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rx:V7Zf/FAxTW3

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3948-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b00000002340b-2.dat	upx
behavioral2/files/0x0014000000022969-6.dat	upx
behavioral2/memory/3948-1912-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vulkan-1.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe.manifest.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe

C:\Users\Admin\AppData\Local\Temp\09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe
"C:\Users\Admin\AppData\Local\Temp\09a9838da8ceebae237951c0605faf11f29bac1cba488b5fc162233454899daa.exe"
1⤵
- Drops file in Program Files directory
PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1015551233-1106003478-1645743776-1000\desktop.ini.tmp

Filesize
48KB

MD5
190d0798017cb297dec99aa52253bc06

SHA1
ef611466617f9bf54a6b89d9c8f7c790b65b041c

SHA256
ef64ef3d0d637a8fdd2a9df82debe34fd301175dd4f58f8dbdc1cb8e112a9cfa

SHA512
edb044b19b82de192c7efa269e6e3643a57d4b39971e0503723543d063653b00ac1df71382225b6ce776b929bc8e047627ea6bcc43447b37f4b79e22bef47052

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
c6bf4b8ac3d29ec6dd95ddd7adfd2560

SHA1
c9746cef23b097ad14affff2084ad65d255d3480

SHA256
ce0fe02ddfc96e8bf6dee127a9d5c22dd5e83e0d52d624df3881afd566dbf0c0

SHA512
0b219f56cded58fda1276963c6c70ab51b8568a4fb5525a9996f9ceca8d3b8f88a4fc0b26da24551d203aeefb8cb90cde16cbfcf7a30a6978a4d8bfa0c0b5ba8

Download Submit
memory/3948-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3948-1912-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads