8146f86fb87f856b20aef4937b2a707761a1332afeba90685f0639a421e28469

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3dab9cdea16a2d445e7fea82ef22aab0N.exe
Size

53KB
MD5

3dab9cdea16a2d445e7fea82ef22aab0
SHA1

ff7f684151d20a39b6a88dbde4594c43b0f4eaf3
SHA256

8146f86fb87f856b20aef4937b2a707761a1332afeba90685f0639a421e28469
SHA512

d71520a0ecfa8726c27c2e1c2c65fe6cf7f8dd6e53f568906827b354341b14fb8432a00fc36043b5fe68c50afae9961ad88ea4248f1542e15aaf7fca3ec803a1
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WZCqCL:V7Zf/FAxTWoJJ2WjWZCqCL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4060-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000023248-2.dat	upx
behavioral2/files/0x0014000000022933-6.dat	upx
behavioral2/memory/4060-1864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	3dab9cdea16a2d445e7fea82ef22aab0N.exe

C:\Users\Admin\AppData\Local\Temp\3dab9cdea16a2d445e7fea82ef22aab0N.exe
"C:\Users\Admin\AppData\Local\Temp\3dab9cdea16a2d445e7fea82ef22aab0N.exe"
1⤵
- Drops file in Program Files directory
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3642458265-1901903390-453309326-1000\desktop.ini.tmp

Filesize
53KB

MD5
42fca2065e17486d4cadc65a0752e40d

SHA1
06fd15cce02623052172cd6bf99a21ae1f8b4a4f

SHA256
04e45cefc00aadf6c580c62db5d70e5f7fce51d714b6ffca0c4e8dc3c34070f2

SHA512
7a14df71319342e877c8e8ec84196d3a61c26c1a5caaee3f01aacadce52235cf4eceb9ee240d902a4baadf6cc05a66397b33ada13af56b28d37bf4f30be19b5f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
e3978a3eb0c7cf61f1adb20caa6c15af

SHA1
c3bf173bfc8dc705c039e8dd8c04e5ffae468dea

SHA256
53cae58861cb07faeed41244d5ac8501bb458dc498cd91d558c80f33201be991

SHA512
982d3b70f285574c7e1d00df2516c6628e20a0e0cb1c8f74a8f4892f3a2cd9278901223a00e7c1c8298938af5114e77705f5baa381d1e83c89e4af871cb13d3c

Download Submit
memory/4060-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4060-1864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads