790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea

Analysis

max time kernel
150s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
Size

81KB
MD5

c2cff3ff60d9fef341f7417960685372
SHA1

7077197efae66d891cce81015c40f8319dd22dce
SHA256

790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea
SHA512

9b25c395d38de8ea504c3a26260bbab59a7eb894769ed8543718adb0bb46641bfba549bd2b732d3402e2b8c582e9f5142acb2a713eeb32f7296dce97cac66389
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Oym7n97nhDz:fnyiQSonysZ9

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4639) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4064-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-2.dat	upx
behavioral2/files/0x001400000002291a-6.dat	upx
behavioral2/memory/4064-1592-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ru.pak.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\BlockSave.mht.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe

C:\Users\Admin\AppData\Local\Temp\790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe
"C:\Users\Admin\AppData\Local\Temp\790b0c550f2110bec3677076aaab2c588e3d6d87b87a35e58e90678c5abd9bea.exe"
1⤵
- Drops file in Program Files directory
PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
82KB

MD5
7623c1d9fc2d6757ef752b2b7a531a4b

SHA1
fe8d6f7bb81120d4ffadbb32d5378b4b9c4db19f

SHA256
eeab68b89a644f9dd0249fa368f1474c0829337a64771675943c48de48748c87

SHA512
b69c793828e950e4b2c85e079cf4423bd71677cddfae89b2c00a237c6587770fcd0578317bf0adb9f2701e161ef62fe2bf569625f46efd5f23de35462f8c1256

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
a2b2320730d01e609be61c15de8d78f7

SHA1
c5de9e9ab914246b7f91614c9a2a30ecdcc42018

SHA256
8f1075fef0346b6088e2a6bc8440cb0f0254ed7c0a8652d0ce42f13aeef76bf6

SHA512
379fa7b9c3938dad21a7eec963ceed28dda180f15bff9a97a17301e21c6fe8e28dade44340edccb5d17150ea734c687d3e55d9a834b9b63a309d47e03b13aa09

Download Submit
memory/4064-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4064-1592-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads