15f691406dfe6022e3a5a6fba94ede8690ea9d8ca3a1a9d8cb27f2ae5f244441

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c4e8c59ebaf699ec438c7324551edb0N.exe
Size

158KB
MD5

9c4e8c59ebaf699ec438c7324551edb0
SHA1

f468284c44d3ca98ee7537d2cd469729733d7128
SHA256

15f691406dfe6022e3a5a6fba94ede8690ea9d8ca3a1a9d8cb27f2ae5f244441
SHA512

8a845e982231b2a85a6f6c7ee57c33fc75ce3160dd93d1f723f0215091323b7c2602a5ae74621ba9488b0ab15636bfc21f42215b4f0f5043785385346ce6c159
SSDEEP

3072:fnyiQSoe2YIRBJcKiY9tNTbg5u0WfA9skTWG6KxQML6tjm9Y9A+tSo5VVRI:KiQSocgLzdGn6K85m9OA+tSo5VVRI

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2148-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002340d-2.dat	upx
behavioral2/files/0x001400000002292d-6.dat	upx
behavioral2/memory/2148-1714-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\am.pak.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	9c4e8c59ebaf699ec438c7324551edb0N.exe

C:\Users\Admin\AppData\Local\Temp\9c4e8c59ebaf699ec438c7324551edb0N.exe
"C:\Users\Admin\AppData\Local\Temp\9c4e8c59ebaf699ec438c7324551edb0N.exe"
1⤵
- Drops file in Program Files directory
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
159KB

MD5
a386874562671d114ece7b5a2dce1ae8

SHA1
53a655977b9949e727b4a3f63fbb6643338a60a7

SHA256
8ad03bb1aa83be29d6eb0748c362274530b264a08203877344722eb552cce294

SHA512
d4baa27c42d4723a34bcd3632c255ffd92adb07e605f826427f03464864980cd9b3b324246b4f832557aa8b615015e2f07afa054f468b966340d65230db696b6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
257KB

MD5
e9920e703f362b8b89310a93ea62bb6c

SHA1
6774d166a7dd7723211bce82cf332ce8dd2c4a9c

SHA256
18d566ba4bdcd8e419a229f9f582ab536778bbc89c2700874912bf804a4dd032

SHA512
49633ae7c4d82da30a96192010822333743cb314cd0a2b97c517b3f8df547beee136d6a07ef9667c2218130fe5b36423adc9066d385217175d99010f37d992fe

Download Submit
memory/2148-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2148-1714-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads