a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
Size

53KB
MD5

3bf56b70b861a6c866a4bcfe0df30005
SHA1

0273f4c2d73ea62be0b5eb9b3edc1b7c54fbc8c1
SHA256

a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656
SHA512

cdac814cd2fe6b1bcb37a52c1deb12d0e1ea395bad0bf8a432c31c24cb8ff7423522b35beb6db8d79aaf9d3bb8c1e9247f1ac6de952919edb98db85aa88cd696
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZum0mJFE:KQSo7ZfFE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023403-2.dat	upx
behavioral2/files/0x0014000000022923-6.dat	upx
behavioral2/memory/3052-734-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\v8_context_snapshot.bin.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ar.pak.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe

C:\Users\Admin\AppData\Local\Temp\a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe
"C:\Users\Admin\AppData\Local\Temp\a4e592ded37a8327b8664496efea1784517694f13c35331d6a274e0605a13656.exe"
1⤵
- Drops file in Program Files directory
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
54KB

MD5
42687a00baf0f2b92cfd65fb446873b4

SHA1
b0ddcbebfe807b828a7f0190aaac7e3201deface

SHA256
3ab9b6bd70a84da1819d2604aad5dd33e2d8a75d3c0718c7d65db65f5d26651e

SHA512
ee74ba34580908a460d0d08041345762540112e06102394137333fe1b4d0344dea1ba4022d7e6068f1df1a892afcbb2d50c3994fb9c4f611d8e18f08cb266df2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
562022348c7d9dd93e3a7af2890912f1

SHA1
0950f81ee4a9369219a518ec69156dcd131d17ba

SHA256
d2c0febce539b89d00fd560f5bd1900cb797d5758ca879520c92ddccfe49332d

SHA512
d065d49eb39610c69d1c42d1a003f8318f2a89081cb7eb7c36e5b93a4f1744d4621dedd1b0db70c6efa5b2f17d8c3571585a24ad2b33f1d086015fb378a07733

Download Submit
memory/3052-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3052-734-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads