a194e27e1182e83ea3cbcbdaec703a0f8b689d4f1ba87fc5ed0ec3e8e4870780

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0135c75a49d7ed658d4b47935fc23b70N.exe
Size

70KB
MD5

0135c75a49d7ed658d4b47935fc23b70
SHA1

23e89959db075c6fcfa0e717849733bb7ace0ab9
SHA256

a194e27e1182e83ea3cbcbdaec703a0f8b689d4f1ba87fc5ed0ec3e8e4870780
SHA512

5dcb5f01612b41a0b20811868224c844e72c40db137e883d1fafcdd22627a36f3fe24cf435759754b1655f7c02249f95374aaa045a4637050da17965684c4cac
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZqpBpd:fnyiQSo7ZE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2864-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233f4-2.dat	upx
behavioral2/files/0x0014000000022923-6.dat	upx
behavioral2/memory/2864-1802-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\gu.pak.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lv.pak.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	0135c75a49d7ed658d4b47935fc23b70N.exe

C:\Users\Admin\AppData\Local\Temp\0135c75a49d7ed658d4b47935fc23b70N.exe
"C:\Users\Admin\AppData\Local\Temp\0135c75a49d7ed658d4b47935fc23b70N.exe"
1⤵
- Drops file in Program Files directory
PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
70KB

MD5
455898f6e81fa3868e9d7f8c717227f3

SHA1
e2cca1a647707999a8f32fa05fd2b1f67d6126ef

SHA256
651ccf51c9aeecd1656ae105b8d7fb5c0e88d0a475f030c4926b2eae35774a75

SHA512
621c448fb0c099805af0bd1ae5c39ff9d3cfe301a481454f65180c0b1851c973c8bb17e8e768ca8887d75819efad62317b7d417e296248c7fe0e68bc02d6d038

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
e57a52ca70e14253e1d293122ab4f391

SHA1
25e07e8439f65c88ef443572ae1e176efb40c529

SHA256
37ba70b3bd37cd5769f5e3591be42da20225ccc61ed1626220ffa02c48b666ba

SHA512
4bd8957af00b25806839abfc4e73b6c202573511e0c1726057ebca784d3b418f3412c781bbef679c7e36889860725fd4a608711c4cfec14da0e4467a8efac618

Download Submit
memory/2864-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2864-1802-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads