0197a32730359b172767f3f9062d04416ebd04911289b58f6df46536698e787e

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fef0262120cad84b2f55fc1add0940N.exe
Size

74KB
MD5

15fef0262120cad84b2f55fc1add0940
SHA1

397bcbdb256185e7d1cd56509de4539b68efe9fb
SHA256

0197a32730359b172767f3f9062d04416ebd04911289b58f6df46536698e787e
SHA512

eafdf42e56a8872548a216590d7b04e414b6c98e4ab64e6d8bda4f05beda06232d5ea3fc51f843470a6b5b6288449cb582817e48cb29dcea7cac27d93cbb43ba
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xCut3iZ:fnyiQSoPut3k

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4604) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1736-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023468-2.dat	upx
behavioral2/files/0x000600000001e5db-6.dat	upx
behavioral2/memory/1736-1879-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	15fef0262120cad84b2f55fc1add0940N.exe

C:\Users\Admin\AppData\Local\Temp\15fef0262120cad84b2f55fc1add0940N.exe
"C:\Users\Admin\AppData\Local\Temp\15fef0262120cad84b2f55fc1add0940N.exe"
1⤵
- Drops file in Program Files directory
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
74KB

MD5
62c5c8dd8c705336f9979c85c78fa391

SHA1
1bef4f9488a2be5e7e5e348ebd773d421c071529

SHA256
52f8c7ef53493e9c4080f3f4c421b135566ce2031d9bc6a5a404debc8416c77f

SHA512
705ddc14005ab6ea83ed2b5008dbba366d25004f9f68113ebb6a0a121b14b8ed63a1901016dee2b41af4c6ebe49fe25e51e6e80ab3441cd3a0be28917ca7cf93

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
cb0b0cab303cdbd1f4592c8e90d0354e

SHA1
a4ab334e6fe7375293eafcd70d1a8eec41397f46

SHA256
ce4894d2c5460787b5afb8f38f19d31fa2e0492a538da3d9d6fe4b9947c9b786

SHA512
674188fb5c6d0ca7da6a8e9bec8524450bfb0f13c5e7daa2a1c05ebe5370305a489153db5c06b035cbc8d3d35d71fe22c807746c2fa7ef789467f3082a4646c9

Download Submit
memory/1736-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1736-1879-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads