14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
Size

55KB
MD5

528c6f5d8ede1d1eb5acb13aa281dff6
SHA1

88f5e195f63abe727d885371fbf85960105afcfc
SHA256

14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f
SHA512

20b960670962314d4adf842a7887b6724387bba98689592dda99c846de13eefc31c92bc2ba970fa6271d54ec3fd0bd92d9ba68e251d33e7d7c123c1d723284a4
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw/x/fxRfxCZj1hcaEWcxINgjn+4O:V7Zf/FAxTWOx/fxRfxCZj1hcaEWAIy+x

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1048-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0006000000023252-2.dat	upx
behavioral2/files/0x0004000000022932-6.dat	upx
behavioral2/memory/1048-1780-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe

C:\Users\Admin\AppData\Local\Temp\14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
"C:\Users\Admin\AppData\Local\Temp\14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe"
1⤵
- Drops file in Program Files directory
PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2753856825-3907105642-1818461144-1000\desktop.ini.tmp

Filesize
56KB

MD5
a1d3b7f593a0efd2911c83ee4ae1add9

SHA1
549a5b420c662073da282c31cae81161c1cf1b50

SHA256
6095f9132a59984407185bf302e759e1c65e3a0ceeb4845e06a043f4d407019a

SHA512
fb509cb2e192021324b87c910d34406a8be6d49d1b7bfbbdb81b941878633008fa3986e7bd77b5864883851fac234bb0e96e77114ea8cd20fb313c4f6affbdfa

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
e0e50967ad1f46cacde47442c63635c3

SHA1
1c9db3fca643f567e450289c6a22c0ca72790a1d

SHA256
dd82d01efb9a4ae888e3682f07da93142bcf2080b044eef54a4aa5d8de441074

SHA512
adc69c36a9d2addc876e9486934d88b66e5c31a585b22c10f108f0fdf942140f16cf01b8199dfe85c4858e568502351d5a089a5479702bc6dd0605f8048b295e

Download Submit
memory/1048-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1048-1780-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads