884192a1c2e316f7d2a7f2410dcde1097a88a479ce9463fc778efdab79ac9635

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
Size

116KB
MD5

14a2fbe106a3c7a72ab537f56a6a6ee0
SHA1

cf553f9339d0673debcc8a1d0b2fb8879f247783
SHA256

884192a1c2e316f7d2a7f2410dcde1097a88a479ce9463fc778efdab79ac9635
SHA512

a6a882b11e47dc7ca954d7fe70864d87606eab4e41439fce9936e8f8d359411646aed66d7cfa7170b46d92103bf52f827d68d1a1b72d1055d0d261f710c90434
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8+zCugTWn1++PJHJXA/OsIZfzc3/Q8+f:fnyiQSoUuIQSoR

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023478-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/4940-1806-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	14a2fbe106a3c7a72ab537f56a6a6ee0N.exe

C:\Users\Admin\AppData\Local\Temp\14a2fbe106a3c7a72ab537f56a6a6ee0N.exe
"C:\Users\Admin\AppData\Local\Temp\14a2fbe106a3c7a72ab537f56a6a6ee0N.exe"
1⤵
- Drops file in Program Files directory
PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
116KB

MD5
2233597f8b67cb608e32d71db40f59f7

SHA1
517512e79c96a185b54f468bc3b6f434de27730c

SHA256
19c9db8b447f157c4481a6ff7de399881765f03e3b20b38dabd9a5ec60fe98b1

SHA512
ecbe26a7f0b9fb31e8d86cafc8f3d21348202a55fdf5123947f952f34a7057791795a5d4efb8cb97fde48d7f0008a042231aca32dcf3b25068825d016c03a0ad

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
215KB

MD5
4be740ca7b9d19f038820d0add2d399a

SHA1
76fc8c85cf32104bc9f7d3ac58ba3290a96284a5

SHA256
4ec41cae304f0b70b020326e793326a9c683d1748c4681835690bdf80e680b81

SHA512
100a4f6718ee23c5985444435a8781bddff06963ccac9325d1560bedaaf5f1b9dc6d0ec65ccf4f7a1f9746fab7a8d1c2dfc63546223feab3592426039e4f42ba

Download Submit
memory/4940-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4940-1806-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads