1120d26c0db3a0d60352aa9ed55afe65ae5cfe20448c55758150997b6ea3ee03

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a8da668103601848692927a5386720N.exe
Size

142KB
MD5

33a8da668103601848692927a5386720
SHA1

ea7e113d3020f6360c3b0b6bc60ac209bf89ea77
SHA256

1120d26c0db3a0d60352aa9ed55afe65ae5cfe20448c55758150997b6ea3ee03
SHA512

e18026c283d8941e27a7bc8bec7fa8dd8a12324af80514d84af76eae898fc4b180915f08043741c1846c64062cdbb4d9e9038a1a3cd018bd13a92915432ad64f
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCK:+nymCAIuZAIuYSMjoqtMHfhfM3A86

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3228-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000023256-2.dat	upx
behavioral2/files/0x0014000000022941-6.dat	upx
behavioral2/memory/3228-1508-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	33a8da668103601848692927a5386720N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	33a8da668103601848692927a5386720N.exe

C:\Users\Admin\AppData\Local\Temp\33a8da668103601848692927a5386720N.exe
"C:\Users\Admin\AppData\Local\Temp\33a8da668103601848692927a5386720N.exe"
1⤵
- Drops file in Program Files directory
PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2480455240-981575606-1030659066-1000\desktop.ini.tmp

Filesize
142KB

MD5
684d1aa02fdd9ee19f7ba3d3569f3848

SHA1
3c7ed8ede95971f9d4813736290e0d5f2c837b55

SHA256
665dc574a348cdf25a0ea22f290ff85f82d863b5bf11b2c2b480de467976b63f

SHA512
5f90137105f90c5056223aec807baebbe5228c63fd6949483befaaff335bf9b7585f28e8cf7dfb8387a862102ae847888025cd113e992d4467692924869e2ba8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
241KB

MD5
4c6208b7026dce63cc7a4f277ba08f64

SHA1
85d5f67c0904e5313a39dd09177aaa510ccf0bb9

SHA256
00bde7dfc4fa0f97412afb49714915a97261f3aedd331babc936b3d630ab16b3

SHA512
ea515701302868b1fa14976dd735243bc039f3e96f6db606fcf2f3e7e743e8a77173d3844029c6507a62e1d40eeed79001ff245f48847c2b7b4d297ef0a46991

Download Submit
memory/3228-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3228-1508-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads