62b99a534b5d2534b71d302ca8ff74121346b9ccc0bb060a1cf8f3f52332824b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e330a219d8bcd72de91f2c204652d0N.exe
Size

32KB
MD5

10e330a219d8bcd72de91f2c204652d0
SHA1

fc413935fbc2b0f915fbbc76efecbc61c4b29ef0
SHA256

62b99a534b5d2534b71d302ca8ff74121346b9ccc0bb060a1cf8f3f52332824b
SHA512

642815119da1fa521d61c9fe629c8d54e09e84849d6113cad296e31b6a5abdc1bf9d858855bebcb9a1d17a146f4c5c13b7f535ee2b7d5bb30c325c169c5533ae
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMc827SKNx27SKNvzcF/MF/h26:CTW7JJ7TG2p26

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5334) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/892-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00060000000232d4-2.dat	upx
behavioral2/files/0x00100000000229b7-6.dat	upx
behavioral2/memory/892-1118-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODDBS.DLL.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 look.dotx.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Common.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	10e330a219d8bcd72de91f2c204652d0N.exe

C:\Users\Admin\AppData\Local\Temp\10e330a219d8bcd72de91f2c204652d0N.exe
"C:\Users\Admin\AppData\Local\Temp\10e330a219d8bcd72de91f2c204652d0N.exe"
1⤵
- Drops file in Program Files directory
PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2494989678-839960665-2515455429-1000\desktop.ini.tmp

Filesize
33KB

MD5
7a5895f192a3171af2f5ba4b404cd8c4

SHA1
a8d44cb284b201ea7570aec4610e1feef3208e1c

SHA256
50275d4347c9a34d47d5231f5f9167f5a707273fa884ba161aa381c0b20dff76

SHA512
4afa3c6dd36cba579e715ac7c22684662fcc50b0a77d47754884c6dfa6dafde7d72ff1c597d316930a2c1463aa13b0f60cfa0cc20003dbca84e539815872eb3b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
131KB

MD5
c62c8b5f16a67e153573f4d794f49d41

SHA1
5e0712f2a0c4d5e02b93b2cc755a454f66e76a5a

SHA256
b8679e0fb25570f5c588de010570733a5646e676e678f9d04c71d1285ea84a8c

SHA512
a883a4f96d19c1f5126553ba65e09a3b2b0d6b874287d264c26b326a6d504086ad7f741ac1e963c54e1f5e6c6ad89b6729be1ec70a9efbce9a20eac6200181b1

Download Submit
memory/892-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/892-1118-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads