bb5c7683a913dfa7e4c5f24f492cab080bd5a59ff4c8daad9ae9c7df8bf9dc3d

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

405dc07ad1f29d24a8c88f2b8df9ba00N.exe
Size

44KB
MD5

405dc07ad1f29d24a8c88f2b8df9ba00
SHA1

43c2692b06db991659fc94bf3affee669d9dd79d
SHA256

bb5c7683a913dfa7e4c5f24f492cab080bd5a59ff4c8daad9ae9c7df8bf9dc3d
SHA512

6e43296b7f618231f7dbb8f6a8a19450aedbdd4b3b0e654fbbf8ed7fe6be0788416e13a05128b552897ab2f8756a06bc3e7e3e15987a977a5501e840b2dd9357
SSDEEP

384:FBt7Br5xjL2Kd5AsAoh6n5eaOlIBXDaU7CPKK0TIhqSjyJJXGiSk7TkO:V7Blpf/FAK65euBT37CPKKQSjyJJXGiZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4692) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4556-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233d1-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/4556-2018-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ja.pak.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\en-GB.pak.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\LimitMerge.asf.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	405dc07ad1f29d24a8c88f2b8df9ba00N.exe

C:\Users\Admin\AppData\Local\Temp\405dc07ad1f29d24a8c88f2b8df9ba00N.exe
"C:\Users\Admin\AppData\Local\Temp\405dc07ad1f29d24a8c88f2b8df9ba00N.exe"
1⤵
- Drops file in Program Files directory
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
44KB

MD5
6a12d2c62b59387480ce3d999597c2a0

SHA1
b917cbcab5afc3a81139fdd6fe15582e2ce5062d

SHA256
8653af1153f4a6cf1ba6d938b3483c0e0aebafdda470b3084b2854e24d748542

SHA512
3cab30b6f886145f8d8d1526297a620c6eabd64fa840719e7f2275735373c9c5add8bf85f5118f89bbda1a70c84a9b678b45877a92199db39cefc368df01d0b4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
778224132f93b0ea9533dc46be71ac9f

SHA1
00b5391370593ca86b027626dfa9513b53b24014

SHA256
e534d65d6b993e13b22458c939bed4d7923a6932b5077b411389ade1eebda978

SHA512
42c6f59c5fe536c25338fc898ac05088f797ed106ead1308a718b4f0fa012afa24c6bbec26b869fdaa5f0d00dabc257f9dcdfd8fcee3e44bb960a4a7e43b7f43

Download Submit
memory/4556-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4556-2018-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads